In the United States District Court 
for the Middle District of North Carolina 
Greensboro Division 

Defendant, Brian David Hill 

v. Criminal Action No. 1 : 13-cr-435-l 

Plaintiff, United States of America 

EVIDENCE OF FIRST JOY STRICKLAND EMAIL PROVING 
PRIOR WARNING TO NC SBI AGENT RODNEY WHITE ON 
DEFENDANT'S INNOCENCE 

Comes NOW, the Defendant Brian D. Hill files with the Honorable Court the 

entire Joy Strickland email with Attachments included as Exhibits proving to The 

Court that prior warning was given to North Carolina State Bureau of Investigation 

Special Agent Rodney White on the Defendant's possible innocence prior to being 

arrested by the Department of Homeland Security. Brian was willing to speak with 

Agent White regarding the computer virus or Trojan horse on his computer so that 

he can locate the hacker's unauthorized program which would have proven the 

defendant's claim to be true. All of this could have prevented the indictment and 

arrest of the Defendant as there would have been a further investigation into 

whether or not the child porn was placed on the Defendant's computer by a 

computer hacker. That would prove the Defendant didn't have control over what 

could be downloaded onto his computer as a computer hacker uses computer 

viruses to conduct illegal activities while the target computer gets raided to be the 

fall computer, while the hacker can get away with the crime. 

It has been stated on court record already that Agent White admitted to receiving 
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the email forwards from Joy Strickland as Brian had requested, which was 
witnessed by a U.S. Marshal on the day of arraignment at the L. Richardson Preyer 
Federal Building and U.S. Courthouse, which houses the Greensboro Division of 
the U.S. District Court. So the Marshal had witnessed that Agent White admitted to 
have received Brian's emails prior to his arrest. This email is one of four emails 
sent to Joy Strickland prior to the arrest of him. 

Question is if the SBI had been warned about the potential Innocence of the 

Defendant at the time then why continue to go through with the indictment? 

The second question is that Susan Basko (See Doc# 46, Filed 09/30/14, and Doc# 

32, Filed 09/15/14) warned the U.S. Assistant Attorney Anand Prakash 

Ramaswamy of the Defendant being framed with child pornography prior to the 

change of plea hearing and prior to the mental evaluation. Even Document 37 (See 

Doc# 37, Filed 9/18/14) proves that a Fax was sent to the U.S. Attorney Office 

warning about a possible set up, prior to the arrest of the Defendant. 

So the U.S. Attorney was warned ahead of time of the frame up on the Defendant 

Brian David Hill but yet still tried to offer a guilty plea agreement which caused 

the conviction of him. If Brian does have the evidence to prove Innocence such as 

with a Independent computer forensic examination (See Doc# 76, Filed 04/22/15), 

then a plea agreement would not have been appropriate and the public defender 

should have filed a Pretrial Motion for such examination to exonerate and acquit 

the Defendant. The public defender did nothing to submit any evidence to prove 

multiple reasonable doubts which the Defendant was able to prove by filing Pro Se 

Motions and misc. filings. No jury will convict a Defendant that keeps claiming 
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over and over again that he is Innocent and can prove his computer was hijacked 

by a computer hacker by usage of a computer virus or Trojan horse. Then he was 

also able to prove that prior to former District Attorney Phil Berger Jr. being 

involved with the search warrant and child pornography case, he was writing 

online articles postings on his website calling for the DA's father State Senator 

Phil Berger Sr. to be removed from office and calling him a traitor, he has written 

emails which made the Senator look like he doesn't care about the Constitution by 

ignoring all of the Defendant's emails after the July 9, 2012 town council meeting, 

and that Phil Berger is the Mayodan town attorney which would give him 

unrestricted influence on it's Police Department which conducted the search 

warrant, raid, and child pornography investigation along with Reidsville Police 

Detective Robert Bridge and SBI Agent Rodney White. With the evidence that the 

Defendant has of possible conflict of interest on those involved in the criminal 

investigation in 2012, would a Jury really convict a Defendant that has no prior 

record, get involved in politics, started coming after the State Senator by wanting 

him removed from office and fired from the Mayodan town government, and then 

all of the sudden was accused of downloading child pornography right after he was 

kicked out of the town council and written a online posting plus uploaded a video 

on YouTube regarding the incident. With enough evidence in the defendant's 

possession, why wasn't any of this presented by public Defender Eric David 

Placke? Why didn't Placke discover any new evidence nor conduct any 

investigations to discover new evidence in favor of the defense? The public 

defender only sought for his guilty plea. Placke had no interest in acquitting him on 
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any technicality of law nor any evidence which would prove multiple reasonable 

doubts. Placke could have easily proven actual innocence by proving that a 

computer virus had ran on his computer during the time of being accused of 

committing the alleged offense. Placke could have very well brought this evidence 

to the attention of Dr. Dawn Graney which would cause a different outcome in her 

mental evaluation report. Had Placke done his job then the Defendant never would 

have made any admissions of guilt, never would have accepted responsibility, and 

never would have been convicted. The outcome of the criminal case would have 

been different had effective counsel been appointed instead of an overburdened 

public defender that doesn't have the time nor resources to adequately 

represent the Defendant. The Criminal Justice Act needs to be reformed to fix the 

broken public defender office to safeguard every Defendant's right to Effective 

counsel under the Sixth Amendment to the U.S. Constitution. 

Evidence of the first Joy Strickland emails is separated into Exhibits. 

Exhibit A. Joy Strickland email sent from Brian D. Hill 
( admin@uswgo.com ) to NC DOJ Employee Joy Strickland 
( JS trickland @ ncdoj . gov ) . 

Exhibit B. Attachment A - Search Warrant against Brian D. Hill scans 

Exhibit C. Attachment B - Police inventory of seizure of Items of Brian D. 
Hill pursuant to search warrant 

Exhibit D. Attachment C - Reporter intimidated and booted from town 
council when asking a question & YouTube Video on Mayodan Police 
escorting me out of town council 

Exhibit E. Attachment D - General Affidavit From Brian David 
Hill(witness testimony and statement of facts) 

4 



Exhibit F. Attachment E - Welcome! Here's Your Registration 
ConfirmationPassword Redacted - Match.com email 

Exhibit G. Attachment F - USWGO Mail - You better watch out....... 

threatening email 

Exhibit H. Attachment G - USWGO Mail - Your gonna get it threatening 
email 

The Defendant understands part of this email was already filed on docket but is not 
the entire email including all attachments to that very email. This evidence filing is 
to file the entire email on court record for review. 
Respectfully submitted, 




Brian D. Hul ( pro se ) 

916 Chalmers St. - Apt. D, Martinsville, VA 241 12 
Phone: (276)632-2599 
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CERTIFICATE OF SERVICE 



I hereby certify that on April 23, 2015, 1 filed the foregoing 

EVIDENCE OF FIRST JOY STRICKLAND EMAIL PROVING PRIOR 
WARNING TO NC SBI AGENT RODNEY WHITE ON DEFENDANT'S 
INNOCENCE 

with the Clerk of the Court using the Multimedia Messaging 

Service gateway to the Clerk's email, which will file with the 

CM/ECF system which will send notification of such filing to the following: 

Mr. Anand P. Ramaswamy 
Assistant United States Attorney 
101 South Edgeworth Street 
Greensboro, NC 27401 



Brian D. Hilr( pro se ) 
916 Chalmers St. - Apt. D 
Martinsville, VA 24112 
Phone: (276)632-2599 
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Re: email inquiry 



Subject: Re: email inquiry 

From: Brian Hill <admin@uswgo.com> 

Date: 12/5/2013 5:34 PM 

To: "Strickland, Joy" <JStrickland@ncdoj.gov> 

MIME-Version: 1.0 

Received: by 10.52.189.233 with HTTP; Thu, 5 Dec 2013 17:34:23 -0800 (PST) 
X-Originating-IP: [50.134.38.138] 

ln-Reply-To:<D6CCF8AAB4807D47AB53352D8E9E46AC05ElA834AA@JSIMXS02.JUSTICE.NCDOJ.LOCAL> 

References: <D6CCF8AAB4807D47AB53352D8E9E46AC05E193AE7D@JSIMXS02.JUSTICE.NCDOJ.LOCAL> <CAF+kR9ngfyBiyWvoixTx6o3XGLLH4aDABb5cDCScyg4DJz0+CA@mai 

<D6CCF8AAB4807D47AB53352D8E9E46AC05E1A834AA@JSIMXS02.JUSTICE.NCDOJ.LOCAL> 

Delivered-To: admin@uswgo.com 

Message-ID: <CAF+kR9kdpMLMt=q27Ljupw2RXoYdYz6i48zqMrjF05qhnPYduA@mail.gmail.com> 
Content-Type: multipart/mixed; boundary=047d7baccla45c75a504ecd3a5ea 

Dear 

Joy Strickland 

Assistant Attorney General 

Law Enforcement Liaison Section 

North Carolina Department of Justice 

919-662-4509 ext. 4400, 

I am now aware after contacting the SBI Office, that I am under investigation by the Greensboro, NC SBI Office, under Agent Rodney White. I like for you to keep a record of this email for your 
records and send a carbon copy to SBI Agent Rodney White. You may even share this with the Attorney General if you feel it is appropriate. I am even willing to supply the appropriate affidavits 
if required. My family also are witnesses and are willing to produce affidavits then notarize them then send them to your office if necessary. 

I am representing myself pro se until I can either afford a lawyer, am appointed a lawyer, or one decides to help me pro bono. My only source of income is Supplemental Disability Income (SSI) 
from Social Security, getting medical help from Medicaid, and food assistance from EBT. I have type 1 brittle diabetes and mild autism. I thought this is something the investigator should be 
aware of. I have all the medical records proving this and one of my former doctors was Dr. Steven South of Greensboro NC, and the patient record I am citing is Brian David Hill, born on May 26 
1990. 

I like to introduce evidence in my case that helps prove my innocence claims on the day of the police raid(Attachment A) to the Mayodan Police. During the raid I told the chief of police of 
Mayodan that it was a Trojan horse that I believe was the cause behind what caused the raid. I may have told the detectives about this as well but I cannot remember as it was 15 months ago 
since the incident. I received a lnventory(Attachment B) of all my property that was seized. Due to being threatened by either the police chief or detective sergeant saying things to me and my 
mother, and grandparents like "Fess Up!!!! We know you did it!!!! You better fess up or else your mother will be held responsible." Also I was being intimidated by the police chief on writing a 
hobby blog news article(Attachment C(2)) about how he kicked me out of the town council, after telling me "This is Serious!!!" and was scaring me then accused me of slandering him on my 
news website, which is why I didn't defend myself verbally when I was falsely accused of slandering the chief, cause I was afraid of him. He was also angry due to a YouTube video(Attachment C) 
that I had uploaded showing me confronting the state senator with a camera to ask him questions as a news reporter, and was escorted out by the police chief which the video shows, then 
intimidated and threatened me in the town municipal lobby when my camera was turned off. After that incident on July 9th 2012 I was under criminal investigation for possible child porn 
downloading and distribution. 

Something the SBI needs to also investigate was a finder binder that happened around anywhere between July and August 2012. The driver on record was Roberta Ruth Hill my mother. She was 
on GMAC insurance at the time, and the Mayodan Police intervened to take the case even though the incident happened on private property located in Madison, NC. Of course all information 
due to the finder binder I believe was used in the search warrant. I had long suspected that the finder binder was foul play to further punish us for me writing that article about the possibly 
corrupt police chief and gather information for the search warrant but proving it is difficult. I had tried to get a former insurance fraud investigator to dig up all insurance records on Roberta Hill 
including possible police reports that the insurance provider had likely acquired regarding the finder binder to see if the person that made the claim and wanted my mom's insurance 
information was in any way connected to the police or District Attorney in any way which would be probable cause to initiate a FBI or SBI investigation into the matter to interrogate the finder 
binder claimant to see if she was paid money or given any favors by the Mayodan police detective or Reidsville police detective to cause the incident to gather enough information for the search 
warrant affidavit. Also my IP Address was manually entered into the Boca Raton, Florida-Based "Child Protection System" and not automatically flagged as the search warrant said, which I 
discovered from the investigative news reporter that is looking into my case. 

I am also presenting a unsigned and non-notarized affidavit(Attachment D) which I will be happy to sign and notarize if required by the SBI/DOJ. It is my witness testimony on a Trojan horse that 
got on my computer mysteriously and started running rogue copies of P2P applications and sharing possibly unlawful data without my knowledge nor consent. I did however discover the files 
this Trojan horse was sharing by opening the folder location using the Windows 7 task manager. While the Trojan horse was hacking my computer, I think I had external hard drives connected 
which the hacker may have also compromised during the incident. I had no idea what it was sharing or doing that was in any way illegal until the raid and the ICAC task force got involved until 
the day of the police raid which is why I panicked a bit then tried to explain to the police about the Trojan horse. 

Due to the threat, coercion, and intimidation coming out of the Mayodan Police Department, I confessed falsely to the two detectives on August 29th 2012. I was shaken up to the point where I 
didn't just make a false confession but signed the documents without really reading and understanding them. Also during the interrogation that was unannounced, I was separated from my 
mother then interviewed by Robert Bridge and Todd Brim. I was interrogated I think close to around lunch time and I have type 1 brittle diabetes and the detectives never checked my blood 
sugar before, during, nor even after the interrogation which would severely affect a quality interrogation, putting me under significant stress which would produce false confessions. I also did not 
have any glucose tablets nor any insulin with me at the police station. I am also mildly autistic so I can repeat stuff from other people including stuff from the search warrant. There was a study I 
am citing that I need to find again then send to you that autistic people can falsely confess to crimes due to an authority figure or a so called them being the autistic person's friend. I was not 
given any advocate during my interrogation and was being asked political questions(Agenda 21 and I think NDAA) at the beginning from what I remember and at the end they asked if I belong to 
a cop killing group called the Sovereign Citizens due to the detectives finding a "Don't Tread on Me" Gadsden flag on my computer. Of course the flag does not mean that I in any way, shape, or 
form are connected to the Sovereign Citizens group. Because of the ridiculousness of the claim by the detective, I ended up having to send an email inquiry to a random Sovereign Citizens group 
asking if I belong to them to gather evidence that I am not which they never responded to cause it sounded ridiculous since I never belonged to any Sovereign Citizen group in the first place. 
The only political groups I had any affiliation with in 2012 was PANDA which is People Against the NDAA, We Are Change NC, Planet Infowars social networking site, The Patriot Coalition or at 
least not a member but working with it's founder, and I had contacts with Infowars. Also of course I founded and ran USWGO Alternative News which I had shut down after the police raid as a 
precaution, scared that keeping the site up would incite criminal charges. I also had shut down USWGO Alternative News during the Righthaven lawsuit fiasco. I did revive the website which has 
been documented by the NYTimes article on me and the lawsuit. As of now USWGO Alternative News is shut down and has been since the raid. 

During the raid the police falsely accused me of having illegal drugs due to Ink Refuel kit syringes and insulin syringes for my diabetes. They falsely accused me of having a bomb in my safe due to 
my three DVD cases being wrapped in Aluminum foil. The reason it was wrapped was a attempt to create a poor mans Faraday cage to protect my DVDs from possible EMP attacks from nukes 
that could come from Iran or any other country. The police falsely accused me of owning firearms which I had none of. I can also present to your office an affidavit of how the police treated me, 
my mother, and my grandparents during the police raid and the day after. The way the police treated me violated my civil liberties and right to watch what the police were doing. I was kept out 
my own home for 3 or more hours, was not even allowed to make a phone call, any cell phones we could use would be confiscated as evidence, and me and my family were forced to stand or sit 
outside our home for the entire time. I could not even grab a notepad to take notes on what the police were doing. They could have planted files on me and I would have no proof of this, and 
since the economy is bad no police officer will defend me since they are getting a paycheck every month from them, because I simply made an enemy of the police chief of Mayodan, the same 
PD that conducted the raid. 

Also the police admitted to examining one or more computers and possibly hard drives prior to sending off to forensics. The police detectives are not forensics experts nor do they have a 
controlled facility to properly conduct the proper computer and hard drive forensics, otherwise there would be no need to send to the state crime lab. There were no SBI Agents present during 
the police raid and during the interrogations. The only time the SBI got ever involved was examination of my stuff and forwarding a request for a administrative subpoena and that seems to be it 
from all information I can get from different employees of the state government and search warrant. The detectives could have planted evidence since they had access to our property before 
the crime labs and of course if they aren't forensic experts then they could have contaminated the property evidence before being sent off to the Triad crime lab. The search warrant has 
contradictions, and my criminologist friend told me after examining the affidavits that the detectives admitted to watching child porn the way they worded it and said it almost sounds like a 
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confession or expert testimony document. You can ask me for her testimony on examining the search warrant affidavit and I can give you her email and/or phone number to get the information. 
Statement of Facts regarding my life since the raid 

Due to my autism, I ain't very social and did not leave the house a lot in Mayodan. I was getting more social when I was getting into political activism and trying to be a Alternative and 
professional news reporter. I now live in the state of Virginia and have a online dating profile at match. com (Attachment E), and have a membership at the YMCA. I have improved my own self 
and improved my lifestyle, I have stayed out of politics with the exception of my case and also tried to stay out of trouble, but the fact I could still be indicted scares the hell out of me and makes 
me want to kill myself. My mom has documented that as a result of the criminal investigation, At one point I kept saying and even typing that I was going to kill myself, and so my family had to 
keep intervening me to not do it. Of course as of now I am fine and that is why I have decided to send this email to both the Law Enforcement Liaison and to the SBI so that I can defend myself 
while I still have open access to all the evidence that proves my innocence, since I won't be able to have access to my defense evidence while sitting in a detention facility while awaiting trial. 
The police raid and SBI criminal investigation is keeping me from moving forward and trying to live a better life. I even attempted to see a counselor but didn't really keep with my major mental 
health issue so I had quit. This criminal investigation just seems to be ongoing and I feel like I can't move forward until things are settled. That is why I wish to give the SBI my side of the story, 
evidence I have in my possession which I believe can help prove my innocence. That way I can move on and try to live a better life. 

I have never harmed a child ever, and I never will, and that is a fact. 

When I was a teen, I was concerned over a girl named Rachel Ashcraft that was one year younger then me at the time I was 16 years old, that was talking to a possible pedophile and had 
reported the incident to the FBI. One of her pictures is on my flash drive that the police seized. So it ain't some random girl photo that I have, it was someone I had cared about when I was a 
teen, and tried to help give me advice in my life to help me change my life to become more social even though I have autism and had trouble with being social back then. 

I haven't even been around children, and never babysit. The only crime I am accused of is a digital crime due to a Trojan horse that was likely the culprit. I have also been heavily political and 
made a lot of enemies. I can list to you the enemies that were coming after me when I ran USWGO Alternative News, and have the motive to set me up with child porn. In the political world 
there is a lot of backstabbing and I had been repeatedly back-stabbed politically and personally by those seeking to come after me. 

I may also have a girlfriend but when I had found out the SBI was investigating me, I told her and she started panicking begging me to go to the media but I was afraid that would stir up a 
hornets nest. She knows what I am accused of, a computer crime that I ain't guilty of, and she still likes me and still wants to date me. If I get put on the sex offender registry then this will 
negatively affect her life and punish her just for dating me, hurt my life, and ruin my life. I live in a Apartment not too far from Martinsville downtown and being put on the sex offender registry 
will ruin my right to live in a Apartment due to the zoning restrictions for sex offenders, I will face major discrimination, and I will be at risk of being targeted by vigilantes that burn down houses 
of possible sex offenders. I did nothing to children, nothing to deserve ever risking to being put on a sex offender registry and I will refuse to register since I have done nothing wrong that 
warrants this. My life has been better since I moved to the Commonwealth of Virginia and do not want my life to be ruined by all of this in North Carolina. 

Threats were sent to me after the raid 

I have been sent multiple threats since the raid. The threats came from a tormail.org account and told me to stop investigating the matter and watch my back, even claimed to be the possible 
perpetrators for setting me up with child porn. I was afraid reporting the threat would stir up a hornets nest or cause them to harm or kill me so I had kept it to myself, but now have decided to 
report the threats to the Law Enforcement Liaison and SBI agency so that they can try to investigate, and find out who may have possibly set me up enough to brag about it and threaten me. I 
was afraid that reporting the threats would make them carry out setting me up as a violent sex offender or worse set up my friends. Now I have decided since I am being investigated and this 
madness won't stop, that I have decided to risk my life and risk my safety by reporting the threats now to the SBI. I thought if I stop trying to investigate my set up then I will become a registered 
sex offender and my life will be ruined so I ignored the threats and then my friends Dan Johnson and Jeff Lewis received threats then Luke Rudkowski was announcing on YouTube that someone 
attempted to use a tormail account to set him up with child porn. I started freaking out thinking that this was whomever set me up that the threats against me were being carried out, then 
when it went as far as Stewart Rhodes, I sent an email to the suspected tormail address published on Oathkeepers.org on an article about the set up, begging them to stop setting people up and 
that I would make more false confessions to the police to get myself more falsely punished to beg them to stop what they were doing, then I received a email from a fake Jeff Lewis on a tormail 
account. He(the real Jeff Lewis) informed me that was not his email address and had Garett from PANDA a forensics analyzer look at my email after giving him my gmail username and password, 
allowing him to examine the tormail email which was indeed another set up attempt on me and first set up attempt made on Jeff from the Patriot Coalition. I heard that email was reported to 
the FBI on record thanks to Garett. Attachments F and G document the threats. I also included in attachments F(2) and G(2) the header information of the emails for your records. 

Final words from me 

I hope by writing this email that I will not be completely set up with child porn as what was being planned by the prosecutor to have me charged or indicted. I had done nothing to deserve all of 
this. It makes me angry and also scared not knowing what to do. This was the first time I was ever accused of any crime. I have always tried to do right in the world, in America, and even in my 
community. I have autism, I am different, unique, but I am not a monster, I am not a predator, and will never attempt to be one. That is my word to the SBI. I don't want to be falsely accused 
anymore and hopes all the evidence I am sending will help clear my name from all of this. 

I have sentimental and completely legal data that I may lose forever as a result of the investigation and the raid. I have independent and personal news interviews such as interviews with Elton 
M. Crisman Jr. a former NASA engineer, James P. Tucker a now deceased news reporter from the American Free Press, Virgil H. Goode a Virginia candidate running for US Presidency in 2012, 
Patrick Henry Jolly a historical figure whom is the fifth or sixth grandson of the Patrick Henry in American history, Oath Keepers at Chantilly VA the site of Bilderberg, and other great people I took 
video of and interviewed. All of those interview files are on the seized hard drives. I have literally tons of hobby photos that were never in any, way, shape, or form pornographic. Those hobby 
photos and videos include photos of the Occupy Bilderberg protest, Pilot Mountain, hanging Rock, Key West Fl, Washington DC, New Bern, Fort Macon, Outer Banks, Richmond Virginia capitol, 
out west which include Las Vegas and Zion National Park, Mayo River, Mayodan town council and accomplishments there, Washington Mills factory in Mayodan that is being deconstructed, train 
tracks that I thought was cool, and possibly hundreds more of completely legal photo sets from every vacation trip I have ever taken since I was a teenager including photos of my pets that I had 
loved which are also now deceased. I also have audio feeds as well as photos of me and people I have interviewed, even people that interviewed me which is WXII12 and F0X8 when being 
interviewed over my Righthaven lawsuit (Righthaven LLC v. Brian D. Hill, Federal US Case Colorado). I am hoping one day I can have my completely legal data returned to me since legal data is not 
contraband. I hope I won't lose everything as a result of all this. I don't deserve to lose all my hobby photos, interviews, and other stuff over a few bad files due to a stupid Trojan Horse. 

A hard drive is the same as a house, because a burglar(Trojan horse, hackers) breaks into my house and starts molesting some women and then takes photos then plants them inside of my 
house, does that mean my whole house should be seized then forfeited, that all of my legal possessions inside the house be seized then forfeited???????? Only contraband should be taken but 
not the lawful data. Being a victim of a criminal act that is in violation of the federal Computer Fraud and Abuse Act does not mean that I should become a convict then have all my lawful stuff 
forfeited. Such actions is not justice and is in itself Orwellian, in violation of the principles of the Constitution and due process clause. 

So I ask that all evidence I have sent you be considered and taken into consideration in this criminal investigation under SBI file. If you wish to interview me then I will be glad to do so and help 
the criminal investigator sort all this out. I am not a predator trying to get away with a crime, I am a victim of a possible frame up or set up operation. I am hoping the SBI has the integrity and 
ability to make things right for me, to go after the real criminal behind all this instead of just settling for me. I also made an inquiry with the NC Innocence Inquiry Commission to see if they 
could go do something to audit the Rockingham Co. DA office, Mayodan PD, Reidsville PD, and the Greensboro office to make sure that I ain't being set up from within, but refused to help me 
since I haven't been convicted nor charged. If you or the SBI agent in charge can help me out, to help look at all angles of the evidence, without bias, to see if there was foul play by the Mayodan 
PD or any others involved in my case, and to help find prove my innocence. 

All attachments are attached to this email. My phone number and address was not included in this email as my family is scared to death of this investigation being a result of me being political 
and is afraid anything I do will stir up a hornets nest. I like to be the only one talking to you at this point so that you can reassure me and talk to my family at some point to let them know that I 
am not going to be dragged into some van then disappeared just for trying to prove my innocence. I don't know what else to do and can't get a lawyer till I am charged so I thought my only 
options were to give any evidence I had to the investigator in my case. To try to prove that I am innocent and not a predator. I am trying to be as reasonable as I can and hope that I will not have 
my life ruined forever due to writing articles last year. 

On Thu, Dec 5, 2013 at 8:32 AM, Strickland, Joy < JStrickland@ncdoj.ROv > wrote: 

If you would like to call me to discuss this issue, you can reach me at the number listed below. 
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Joy Strickland 

Assistant Attorney General 

Law Enforcement Liaison Section 

North Carolina Department of Justice 

919-662-4509 ext. 4400 



From: Brian Hill [mailto: admin(g>uswqo.corn 1 
Sent: Tuesday, December 03, 2013 9:58 AM 
To: Strickland, Joy 
Subject: Re: email inquiry 



Dear Joy Strickland, 

The problem is that attorney was only hired to write the letter to the Mayodan Police Department regarding seizure of my property, and to mirror their response back to me. As of right now I 
do not have an attorney and can only get one that will offer services cheap or pro bono. Another reason an attorney has not decided to help me at this point without charging an arm and a leg 
is because there really doesn't seem to be any kind of case against me but yet my property is still being held by Charles J. Caruso and Todd Brim of the Mayodan Police Department, and Robert 
Bridge of the Reidsville Police Department. He told the attorney that sent the letter, that my property is still being examined by the SBI. I have contacted different people that has told me they 
have no record or any information as to whether my stuff is even being held at the state crime lab under the SBI. I am getting the impression that the police chief is lying to me knowing I can't 
get any information nor an attorney until I am criminally charged as I cannot be appointed one until then, and if I am never charged then my stuff was stolen by the MPD under false pretenses. 
I am confused as to whether there is really any kind of criminal investigation or even forensics on my property. Ever since the raid the whole investigation is unusual and unlike that of regular 
law enforcement that follows regular criminal procedure. The amount of mixed responses I am getting is why no attorney wishes to represent me pro bono is because there really isn't any 
case to represent me on except maybe return of seized property but I need evidence that they do not intent to look for evidence on my seized property as for cause why a court should grant 
my motion to demand the MPD returns my property. Until I have a clear case to need one, I cannot afford an attorney not will one help me pro bono. 

I am living off of social security disability income (SSI) and Medicaid. So at this point information is what I need before an attorney will agree to just help me. 



If there is no case then I like to at least know if my stuff is being at least examined in the crime lab so that I at least have knowledge as to what is going on, otherwise I may be a victim of theft 
by law enforcement that produced a falsified search warrant(already contradictions and the affidavit may not be true) just to seize my stuff and pretend that it is being examined on when it 
isn't. All I can come up with is theories and theories aren't accepted by any attorney or a court. I need to know what are the facts as of now. If my stuff isn't being examined then I need proof 
of it being so, so that I can file a motion for return of seized property since the seized property is not being even being examined in the first place. 

I am hoping you can help me with my confusion on the situation. I have a lot of important sentimental data that is completely legal that was in the seized belongings such as the out west trip 
pictures, a independent video interview I did with a historical figure, hobby photos, hobby videos, and even documents that are of significant importance. I am afraid the police may have just 
seized it to use as if it was their own property. I contacted the US Attorney as Angel Gray insisted but they aren't giving any responses either even though the chief of police made some form 
of a federal indictment threat which isn't being backed up. I don't even think I'm being criminally charged and the whole raid was a joke just to hurt me. 

I am hoping you can explain to me what exactly is going on here. Is the SBI really examining my stuff? are they really investigating me? Is there even a record that the Mayodan or Reidsville 
Police Department really sent my stuff to the state crime lab for examination? and whether they are aware that my stuff was already independently examined by the two detectives that 
possibly contaminated and destroyed possible evidence and may or may not have even sent it to the state crime labs? 

The property was seized at the location: 413 N. 2nd ave. Mayodan, NC 27027 

The IP Address that the detectives claimed was flagged automatically was not automatically flagged but manually entered at the Florida server according to what a investigative source told me 
so that would make the search warrant a perjury. 

My name is Brian David Hill. I had previously lived in North Carolina under that location. 

If I am under investigation then I like to at least know that I am so that I ain't confused as to what is going on. I feel like something throughout the whole raid process isn't legal and have at 
least enough evidence that something isn't right, that something isn't legal what happened to me. That is why I am contacting you and different people asking for answers. 

I had pondered going to the FBI since I cannot afford an attorney to find out the truth then give me back my possibly stolen property. I had pondered going to the Attorney General to right the 
wrongs done to me by the MPD. I know I am writing a confusing email but I am entirely confused about all this. If you can help me that will be great. 

On Mon, Dec 2, 2013 at 12:35 PM, Strickland, Joy < JStrickland@ncdoi.gov > wrote: 

Dear Mr. Hill, 



Your recent email to the North Carolina Department of Justice- State Crime Laboratory Director Judge Joe John- has been forwarded to me for a response. 



In your email you indicate that you are represented by an attorney. Therefore, please direct your questions to your attorney. 



Sincerely, 



Joy Strickland 

Assistant Attorney General 

Law Enforcement Liaison Section 

North Carolina Department of Justice 



This is an informational email and has not been reviewed and approved in accordance with the procedures for issuing a formal Attorney General's Opinion. 
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Re: email inquiry 



Sincerely, 
Brian D. Hill 

Former USWGO Alternative News founder 
admin@uswgo.com 



Sincerely, 
Brian D. Hill 

Former USWGO Alternative News founder 
admin@uswgo.co 

— Attachment C-YouTube Video on Mayodan Police escorting me out of town council.jpg 




— Attachments: 



Atatchment A-Search Warrant against Brian D. Hill scans.pdf 27 bytes 



Attachment B-Police inventory of seizure of Items of Brian D. Hill pursuant to search warrant(2-0CR Support). pdf 


27 bytes 


Attachment C(2)-Reporter intimidated and booted from town council when asking a question _ USWGO.pdf 


27 bytes 


Attachment C-YouTube Video on Mayodan Police escorting me out of town council.jpg 


147 KB 


Attachment D-General Affidavit From Brian David Hill(witness testimony and statement of facts). pdf 


27 bytes 


Attachment E-USWGO Mail - Welcome! Here's Your Registration Confirmation_Password Redacted.pdf 


27 bytes 


Attachment F(2)-USWG0 Mail - You better watch out pdf 


27 bytes 



Attachment G(2)-USWG0 Mail - Your gonna get it.pdf 27 bytes 
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File No. 



SEARCH WARRANT 



IN THE MATTER OF 



Roberta Hill and Brian Hill 



Date Issued i 
nrf Of Applicar 



Nam4 Of Applicant 

Todd Brim 



Time Issued 



AM □ PM 




Name Of Additional Affiant' 
Robert Bridge /fo&Ugr 



Name Of Additional Affiant 



RETURN OF SERVICE 1 



I certify that this Search Warrant was received and 
executed as follows: 



Date Received 



Date Executed 



Time Received 



□ AM □ PM 



Time Executed 



□ AM □ PM 



□ I made a search of 



as commanded. 



□ I seized the items listed on the attached 
inventory. 

□ I did not seize any items. 

□ This Warrant WAS NOT executed within 
forty-eight (48) hours of the date of issuance and 
I hereby return it not executed. 



STATE OF NORTH CAROLINA 

^kmgham County 



In The General Court Of Justice 
District/Superior Court Division 



To any officer with authority and jurisdiction to conduct the search authorized by this Search Warrant: 

I, the undersigned, find that there is probable cause to believe that the property and person described in the 
application on the reverse side and related to the commission of a crime is located as described in the 
application. 

You are commanded to search the premises, vehicle, person and other place or item described in the 
application for the property and person in question. If the property and/or person are found, make the seizure 
and keep the property subject to Court Order and process the person according to law. 

You are directed to execute this Search Warrant within forty-eight (48) hours from the time indicated on this 
Warrant and make due return to the Clerk of the Issuing Court. 

This Search Warrant is issued upon information furnished under oath or affirmation by the person(s) shown. 



Date, / I Name (Type Or Print) ^ 7 I Signature - ^ / /') 




□ Deputy CSC □ Assistant CSC □ CSC □ Magistrate O District Ct. Judge ^^uperior Ct. Judge 



This Search Warrant was delivered to me on the date and at the time shown below when the Office of the Clerk 
of Superior Court is closed for the transaction of business. By signing below, 1 certify that I will deliver this 
Search Warrant to the Office of the Clerk of Superior Court as soon as possible on the Clerk's next business day. 



Name Of Officer Making Return (Type Or Print) 



Date 



Time 



□ AM 

□ PM 



Name Of Magistrate (Type Or Print) 



Signature Of Magistrate 



Signature Of Officer Making Return 



This Search Warrant was returned to the undersigned clerk on the date and time shown below. 



Department Or Agency Of Officer 



Date 



Incident Number 



Time 



□ AM 

□ PM 



Name Of Clerk (Type Or Print) 



Signature Of Cleric 



Dep CSC 
Asst CSC 
CSC 



AOC-CR-119, Rev. 6/12 

© 201 2 Administrative Office of the Courts 



(Over) 



APPLICATION FOR SEARCH WARRANT 



I Sergeant Todd Brim, Mayodan Police Department 



(Insert name and address; or if law enforcement officer, name, rank and agency) 

being duly sworn, request that the Court issue a warrant to search the person, 
place, vehicle, and other items described in this application and to find and seize 
the property and person described in this application. There is probable cause to 

believe that (Describe property to be seized; or if search warrant is to be used for searching a 
place to serve an arrest warrant or other process, name person to be arrested) 

Attachment A 



constitutes evidence of a crime and the identity of a person participating in a 
crime, (Name crime) Second Degree Sexual Exploitation of a Minor 



and is located (Check appropriate box(es) and fill-in specified information) 

[X] in the following premises (Give address and, if useful, describe premises) 
Attachment B 



(and) 



on the following person(s) (Give name(s) and, if useful, describe person(s)) 
Attachment B 



(and) 

[x] in the following vehicle(s) (Describe vehicie(s)) 
Attachment B 



(and) 

PI (Name and/or describe other places or items to be searched, if applicable) 



The applicant swears or affirms to the following facts to establish probable cause 
for the issuance of a search warrant: 

Attachment C and Attachment D 



SWORN/AFFIRMED AND SUSCRIBED TO BEFORE ME 



Date 7 ; 



Signature 




Date 



? Of Applicant (Typp ( 



Name Of Appl icant (Type Or Print) 



bignature Of Applicant 



Magistrate O Dep. CSC Q Asst. CSC [J Clerk Of Superior Court \^<Judge 



□ In addition to the affidavit included above, this application is supported by 
additional affidavits, attached, made by Pet. Robert Bridge, Reidsville 
Police Department 

□ In addition to the affidavit included above, this application is supported by 
sworn testimony, given by 



This testimony has been (check appropriate box) O reduced to writing 
□ tape recorded and I have filed each with the clrek. 



NOTE: If more space is needed for any section, continue the statement on an attached 
sheet of paper with a notation saying "see attachment. " Date the continuation and 
include on it the signatures of applicant and issuing official. 



AOC-CR-119, Rev. 6/12 

© 2012 Administrative Office of the Courts 



ATTACHMENT A 



ITEMS TO BE SEIZED 

The following materials which constitute evidence of the commission of a criminal offense; or 
contraband, the fruits of crime, or property designed or intended for use or which is or has been 
used as the means of committing a criminal offense, namely a violation of NCGS 14-190.17: 

1 . Computers and computer related storage media including, but not limited to, hard drives, 
thumb drives, CDs, DVDs, floppy disks, flash media, memory sticks, iPods, PDAs 
(Personal Digital Assistant), cell phones and any other mobile wireless devices, and other 
magnetic, digital, and/or optical recording media. 

2. Records evidencing use or moderation of a Gnutella P2P network including, but not 
limited to, screen names, filenames, digital pictures, dates/times of posted images, 

3. IP connection information related to the postings. 

4. Graphic and movie files (including, but not limited to, files bearing file extensions JPG, 
.GIF, .TIF, .AVI, .MPG, and WMV,), and the data within the aforesaid objects relating to 
said materials, which may be, or are, used to visually depict child pornography or child 
erotica. 

5. Computer programs capable of viewing graphic files. 

6. Text files containing information pertaining to the interest in child pornography or sexual 
activity with children and/or pertaining to the production, trafficking in, or possession of 
child pornography. 

7. Correspondence, including, but not limited to, electronic mail, chat logs, and electronic 
messages, pertaining to the trafficking in, production of, or possession of visual 
depictions of minors engaged in sexually explicit conduct, as defined in NCGS 14- 
190.17. 

8. Correspondence including, but not limited to electronic mail, chat logs, electronic 
messages, soliciting minors to engage in sexually explicit conduct for the purposes of 
committing an unlawful sex act and/or producing child pornography. 

9. Any child pornography in any form including, but not limited to, photographs, 
magazines, photocopies of photographs, videocassette tapes, and computer text or 
images. 

10. Names and addresses of minors visually depicted while engaged in sexually explicit 
conduct. 

1 1 . Files depicting sexual conduct, whether between adults or between adults and minors. 

12. Any book, magazine, periodical, film, videotape, computer disk, or any other material 
that contains an image of child pornography. 

13. Any and all documents and records pertaining to the purchase of color photographs or the 
purchase of any child pornography. 

14. Notations of any password that may control access to a computer operating system or 
individual computer files. Evidence of payment for child pornography, including but not 
limited to: cancelled checks, money order receipts, or a debit entry in a computer 
software finance program or credit card statement. 

15. Computers, keyboards, tapes, cassettes, cartridges, streaming tape, commercial software 
and hardware, computer disks, disks drives, monitors, computer printers, modems, tape 
drives, disk applications programs, data disks, system disk operating systems, magnetic 
media floppy disks, Secure Digital Disks, USB Drives, digital cameras, hardware and 
software operating manuals, tape systems and hard drive. 

Signature: Judicial Official/Date Signature: Law Enforcem/nt/Dat</ 

Additional Affiant: Signature/Date Additional Affiant: Signature/Date 



Todd Brim, Detective Sergeant 
Maya^an Pglk^ Department 

Sworn to and subscribed before 

Me this, thegf day of ^^pj^2012 

p hz. 

Judicial Official 




Signature: Judicial Official/Date 



Additional Affiant: Signature/Date 



Signature: Law Enforcerq/nt/Dat/ 
Additional Affiant: Signature/Date 



ATTACHMENT B 



DESCRIPTION OF PLACES TO BE SEARCHED 

The residence, persons and vehicles located on the premises of 413 North 2 nd Avenue, in 
Mayodan, North Carolina. The home ), person ; and vehicles of Roberta Hill W/F DOB: 
05/14/1967 NC OLN: 8867196 and Brian David Hill W/M DOB: 5/26/1990 NC OLN: 
38360908 and/or any other person at the residence of at 413 N 2 nd Ave. to include any 
vehicles located at that address: specifically registered to Roberta Hill and that are 
associated with the home specifically a 2000 Pontiac Sunfire Plate# PWA6942. 

The residence can be reached leaving the Mayodan Police Department: 



1 . Start out going southwest on N 3rd Ave u.Q : m 
toward W Mnm St 



Zoom tc-^s Step Maifl st 



(220) 



3. Take the 1st left onto N 2nd Ave/US-220- 0. 4 m 
BR 



4. 413 N 2ND AVE is on the right 



f ,!? 



^ fo» 6?w 

Signature: Judicial Official/Date Signature: Law Enforcement/Date 



Additional Affiant: Signature/Date Additional Affiant: Signature/Date 



Attachment C 



AFFIDAVIT IN SUPPORT OF SEARCH WARRANT 

I, Todd Brim, (YOUR AFFIANT) being duly sworn, do hereby depose and say: 

BACKGROUND ON AFFIANT: Todd Brim, Mayodan Police Detective Sergeant 
employment, educational and training background is as follows: 

I (YOUR AFFIANT) received my Basic Law Enforcement Training Certificate (BLET) in 1995. 
While in BLET, I received the highest grade point average in my class. I was hired as a Police 
Officer for the Town of Mayodan, NC in 1995. I was assigned as a patrol officer, where I 
conducted investigations into automobile accidents, misdemeanor larcenies, and minor drug 
possessions. In 1998, your affiant was promoted to the Criminal Investigations unit as a Criminal 
Detective. Your affiant has taken several courses from the North Carolina Justice Academy 
including Interview and Interrogation, Police Law Institute, and Basic Cyber Crimes 
Investigations. I have successfully completed the North Carolina Justice Academy's Criminal 
Investigation Certificate Program and I have obtained my Advanced Law Enforcement 
Certificate. 

I, Todd Brim, have previously written affidavits for search warrants in cases involving various 
crimes committed in the Town. 

This affidavit is made in support of an affidavit for a search warrant to search the premises and 
computer equipment of the residence (413 N 2 nd Ave, Mayodan, North Carolina, ), person, and 
vehicles of Roberta Hill W/F DOB: 05/14/1967 NC OLN: 8867196 and Brian David Hill W/M 
DOB: 5/26/1990 NC OLN: 38360908 and/or any other person at the residence of at 413 N 2 nd 
Ave. to include any vehicles located at that address: specifically registered to Roberta Hill and 
that are associated with the home specifically a 2000 Pontiac Sunfire Plate# PWA6942. Records 
indicate that Roberta Hill is the occupant and Brian David Hill is known by police officers to live 
at this residence. Records also indicate that Roberta Hill has a subscription and service for Time 
Warner Cable Internet Service at that address that matches the IP addresses where child 
pornography has been captured during this investigation. 

OVERVIEW OF PROBABLE CAUSE 

The information contained within this affidavit is based upon information your affiant has gained 
from my investigation, personal observations, training and experience, and/or information related 
to your affiant by other law enforcement officers and/or agents. Since this affidavit is being 
submitted for the limited purpose of assisting in securing a search warrant, your affiant has not 
included each and every fact known to me concerning this investigation. Your affiant has set 
forth the facts believed to be necessary to establish probable cause to believe that evidence of 
violations of North Carolina G.S. 14-190.17, second degree sexual exploitation of a minor, will 
be found on the premises, and on the computers and/or electronic storage media located on the 
premises. 

tmlitr $Uf//> 

Signature: Judicial Official/bate Signature: Law Enforcei/ent/D^te 




Additional Affiant: Signature/Date Additional Affiant: Signature/Date 



5. On Wednesday, August 22, 2012 at 1400 hours, Reidsville Police Detective Robert Bridge 
contacted me in reference to a child pornography case in the Town of Mayodan, North Carolina. 
According to Detective Bridge, he discovered that an IP address registered to Roberta Hill was 
being used to download and view child pornography. Detective Bridge is a member of the 
Internet Crimes Against Children (ICAC) Task Force. He has received training and resources to 
successfully investigate cybercrimes involving child pornography. 

6. Detective Bridge requested that I confirm that no other "Wi-Fi" signals were in the area of the 
Hill residence, located at 413 North 2 nd Avenue in Mayodan, North Carolina. Furthermore, he 
requested that we confirm any known occupants of the residence. Through my knowledge and 
previous experience, I know the residence is occupied by Roberta Hill and her son, Brian D. Hill. 
I drove to the residence and confirmed that no unsecured "Wi-Fi" signals were present at the time 
of this affidavit. I also checked the utilities and confirmed that Roberta Hill resides and the 
aforementioned address. 



7- 2), ^r//>- (Jsl3>i^ S/?*h> 

Signature: Judicial Official/Date Signature: Law Enforcement/Date 



Additional Affiant: Signature/Date Additional Affiant: Signature/Date 



Attachment D 



AFFIDAVIT IN SUPPORT OF SEARCH WARRANT 



I, Robert W Bridge, (YOUR AFFIANT) being duly sworn, do hereby depose and say: 

BACKGROUND ON AFFIANT: Robert W Bridge, Reidsville Police Detective 
employment, educational and training background is as follows: 

7. I (YOUR AFFIANT) Received my Basic Law Enforcement Training Certificate (BLET) in 2008. 
While in BLET I received the highest grade point average in my class. I graduated from 
Rockingham Community College with honors with an Associate in Applied Science in Criminal 
justice Technology. 1 am currently attending Guilford College studying Computer Technology 
Information Systems. I was hired as a Police Officer for the City Of Reidsville, NC in 2009. I 
was assigned as a patrol officer where I conducted investigations into automobile accidents 
misdemeanor larcenies, and minor drug possessions. In 201 1 your affiant was promoted to the 
Criminal Investigations unit as the Juvenile Detective. I also was given a position on the North 
Carolina Internet Crimes against Children task force. As part of that task force your affiant has 
completed 110 hours of training in internet related investigations including basic undercover 
internet investigations, peer to peer file sharing undercover investigations, wireless network 
investigations, craigslist investigations and computer triages. Your affiant has also taken several 
courses from the North Carolina Justice Academy including Interview and Interrogation, Police 
Law Institute, and Child about Related Interviewing: The Suspected Predator. 

8. I, Robert Bridge, have previously written affidavits for search warrants in cases involving crimes 
against children, child exploitation, Internet crimes against children and cases arising out of 
various on-line undercover in crimes against children, as well as all other facets of criminal 
investigations. 

9. This affidavit is made in support of an affidavit for a search warrant to search the premises and 
computer equipment of the residence (413 N 2 nd Ave, Mayodan, North Carolina, ), person, and 
vehicles of Roberta Hill W/F DOB: 05/14/1967 NC OLN: 8867196 and Brian David Hill W/M 
DOB: 5/26/1990 NC OLN: 38360908 and/or any other person at the residence of at 413 N 2 nd 
Ave. to include any vehicles located at that address: specifically registered to Roberta Hill and 
that are associated with the home specifically a 2000 Pontiac Sunfire Plate# PWA6942. Records 
indicate that Roberta Hill is the occupant and Brian David Hill is known by police officers to live 
at this residence. Records also indicate that Roberta Hill has a subscription and service for Time 
Warner Cable Internet Service at that address that matches the IP addresses where child 
pornography has been captured during this investigation. 

OVERVIEW OF PROBABLE CAUSE 

1 0. The information contained within this affidavit is based upon information your affiant has gained 
from my investigation, personal observations, training and experience, and/or information related 
to your affiant by other law enforcement officers and/or agents. Since this affidavit is being 
submitted for the limited purpose of assisting in securing a search warrant, your affiant has not 




7 



Additional Affiant: Signature/Date 



Additional Affiant: Signature/Date 



included each and every fact known to me concerning this investigation. Your affiant has set 
forth the facts believed to be necessary to establish probable cause to believe that evidence of 
violations of North Carolina G.S. 14-190.17, second degree sexual exploitation of a minor, will 
be found on the premises, and on the computers and/or electronic storage media located on the 
premises. Specifically this affidavit will show the scope and nature of how the IP addresses 
(24.148.156.21 1) assigned to 413 2 nd Ave, Mayodan NC, the home of of Roberta Hill W/F DOB: 
05/14/1967 NC OLN: 8867196 and Brian David Hill W/M DOB: 5/26/1990 NC OLN: 38360908, 
was located and identified in an ongoing undercover investigation into child pornography trading 
on the Internet. It will show how automated tools used in that undercover process recorded the IP 
address sharing child pornography and how automated undercover tools were used to get a list of 
files on the computer at that IP address and to download some of the offered child pornography. 
It will show how that child pornography is known to be illegal in North Carolina. It will describe 
the scope and breadth of the undercover operation and how it relates specifically to this IP 
address and address. It will show that I made a direct connection to the computer at that IP 
address and received a listing of files and digital signatures of those files on the computer at the 
IP address. It will show that your affiant downloaded files of child pornography over a period of 
time from that IP address. It will show what your affiant knows about each of the files that were 
on, and are expected to be found on the computer at the IP addresses (24. 1 48. 1 56.2 1 1 ). 

BACKGROUND ON OFFENSES AND STATUTORY AUTHORITY 

NCGS 14-190.17, known as Second Degree Sexual Exploitation of a Minor makes it unlawful for 
a person if, knowing the character or content of the material he distributes, transports, exhibits, 
receives, sells, purchases, exchanges, or solicits material that contains a visual representation of a 
minor engaged in sexual activity. 

NCGS 14-190.13, known as Definitions for Certain Offenses Concerning Minors provides the 
following definitions as applied to NCGS 14-190.14, Displaying Material Harmful to Minors; 
NCGS 14-190.15, Disseminating or Exhibiting to Minors Harmful Material or Performances; 
NCGS 14-190.16, First Degree Sexual Exploitation of a Minor; NCGS 14-190.17, Second Degree 
Sexual Exploitation of a Minor; NCGS 14-190.17A, Third Degree Sexual Exploitation of 
A Minor; NCGS 14-190.1 8, Promoting Prostitution of a Minor; and NCGS 14-190.19, 
Participating in Prostitution of a Minor. 

• Harmful to Minors. - That quality of any material or performance that depicts sexually 
explicit nudity or sexual activity and that, taken as a whole, has the following 
characteristics: The average adult person applying contemporary community standards 
would find that the material or performance has a predominant tendency to appeal to a 
prurient interest of minors in sex; and The average adult person applying contemporary 
community standards would find that the depiction of sexually explicit nudity or sexual 
activity in the material or performance is patently offensive to prevailing standards in the 
adult community concerning what is suitable for minors; and 

• The material or performance lacks serious literary, artistic, political, or scientific value 
for minors. 

• Material. - Pictures, drawings, video recordings, films or other visual depictions or 
representations but not material consisting entirely of written words. 

• Minor. - An individual who is less than 18 years old and is not married or judicially 
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emancipated. 

• Prostitution. - Engaging or offering to engage in sexual activity with or for another in 
exchange for anything of value. 

• Sexual Activity. - Any of the following acts: 

o Masturbation, whether done alone or with another human or an animal, 
o Vaginal, anal, or oral intercourse, whether done with another human or with an 
animal. 

o Touching, in an act of apparent sexual stimulation or sexual abuse, of the clothed 

or unclothed genitals, pubic area, or buttocks of another person or the clothed or 

unclothed breasts of a human female, 
o An act or condition that depicts torture, physical restraint by being fettered or 

bound, or flagellation of or by a person clad in undergarments or in revealing or 

bizarre costume. 

o Excretory functions; provided, however, that this sub-subdivision shall not apply 
toG.S. 14-190. 17A. 

o The insertion of any part of a person's body, other than the male sexual organ, or 
of any object into another person's anus or vagina, except when done as part of a 
recognized medical procedure. 

o The lascivious exhibition of the genitals or pubic area of any person. 

o Sexually Explicit Nudity. - The showing of: Uncovered, or less than opaquely 
covered, human genitals, pubic area, or buttocks, or the nipple or any portion of 
the areola of the human female breast, except as provided in G.S. 14-1 90.9(b); or 

o Covered human male genitals in a discernibly turgid state. 



BACKGROUND ON MAINTAINING CONTRABAND AND STALENESS ISSUES 

13. Through your affiant's training and experience working cases involving child pornography and 
through consulting with others experts in the field your affiant has learned and believes that 
Illegal contraband such as Child Pornography and other materials like Child Erotica and Incest 
literature is typically collected, stored and distributed by individuals that trade in this type of 
illegal activity. This type of contraband (Collected Child Pornography) is not "used up" as other 
Types of contraband can be such as alcohol or drugs. This type of evidence is usually stored in a 
manner that is easily accessible to the subject viewing these images and is usually stored on a 
computer's hard drive or some other type of accessible electronic storage media, and may be 
stored off-site via the use of an Internet Service Provider (ISP). Additionally, email and other 
data files can typically be stored online, and is usually only limited by the amoOunt of storage 
space used by the account holder. A small 1 inch square object such as a Secure Digital Storage 
card can literally hold up to thousands of images. For these reasons contraband of this type can 
and is usually stored for indefinite amounts of time by the possessors of this illegal contraband. 
In your affiant's experience and training, and through consultation with other experts, it is known 
that in many instances these types of files have been found that were stored for years and 
transferred from and between storage medium and from computer to computer where new 
computers are obtained by those who collect and trade in child pornography. 

14, Collections of child pornography vary in size and in the items based on many factors. Factors 
which can determine the size and extent of a collection include: living arrangements, economic 
status, and age. Older offenders and offenders with living arrangements that allow for privacy 
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tend to have larger collections. 



15. The use of the computer has changed some of these behaviors. Computers allow for an 
individual to collect items and more easily hide their collection from others. The computer has in 
essence, allowed the individual who views or collects child pornography to maintain a certain 
anonymity via the Internet through the use of aliases known as "screen names" or "user names," 
as well as allowing for the storage of the collection and easy retrieval for viewing. The computer 
has also made it easy for individuals with similar behaviors to contact, exchange information and 
validate their behavior amongst each other. 

Through the training and experience of this Detective and others listed in this affidavit, I know 
that individuals who view and or collect child pornography, even if viewing these items from an 
off-site location, generally maintain the ability to view and store these types of items in their 
residence or a secure and easily accessible place, especially through the use of a computer and or 
digital devices for long periods of time. Since child pornography materials are illegal to 
distribute and possess, initial collection is difficult. Having succeeded in obtaining images, 
collectors are unlikely to quickly destroy them. Because of their illegality and the imprimatur of 
severe social stigma such images carry, collectors will want to secret them in secure places, like a 
private residence. This proposition is not novel in either state or federal court: pedophiles, 
preferential child molesters, and child pornography collectors maintain their materials for 
significant periods of time. Computers and other digital media are akin to a filing cabinet or a 
vault. More germane to this investigation, images and videos of child pornography are horded by 
those who possess it. People who possess these images, rarely, if ever, dispose of it as the 
sexually explicit material is treated as a prize possession. It acts as a sexual stimulus and 
provides sexual gratification. Great lengths will be taken to conceal and protect from discovery, 
theft, and damage their collections of illicit materials. The images and videos of child 
pornography may be moved around to different parts of the computer or moved to different 
external media, but it is maintained as a collection for months and years. 

SEARCH AND SEIZURE OF COMPUTERS AND RELATED MEDIA 

1 6. Based upon your affiant's training and experience and consultations with other law enforcement 
officers who have been involved in the search of computers and retrieval of data from computer 
systems, your affiant knows that searching and seizing information from computers often requires 
law enforcement officers to seize all electronic storage devices (along with related peripherals) to 
be searched later by a qualified computer expert in a laboratory or other controlled environment. 
That process is lengthy and time consuming and takes days and even weeks. This is true because 
computer storage devices (like hard disks, diskettes, tapes, laser disks, CD-ROMs) can store the 
equivalent of hundreds of thousands of pages of information. Additionally, a suspect may try to 
conceal criminal evidence; he or she might store it in random order with deceptive file names. 
While an on-site computer preview is beneficial to get an initial glimpse of some of the items 
stored on the media, searching authorities will be required to examine all the stored data to 
determine which particular files are evidence or instrumentalities of a crime. This sorting process 
can take weeks or months, depending on the volume of data stored, and it would be impractical to 
attempt this kind of full data search on site. Searching computer systems for criminal evidence is 
a highly technical process requiring expert skill and a properly controlled environment. The vast 
array of computer hardware and software available requires even computer experts to specialize 
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in some systems and applications, so it is often times difficult to know before a search which 
expert is qualified to analyze the system and its data. In any event, data search protocols are 
exacting scientific procedures designed to protect the integrity of the evidence and to recover 
even "hidden," erased, compressed, password-protected, or encrypted files. Since computer 
evidence is extremely vulnerable to inadvertent or intentional modification or destruction (both 
from external sources and from destructive code embedded in the system as a "booby trap"), a 
controlled environment is essential to its complete and accurate analysis. Therefore removal from 
the premises of some or all computer equipment and related storage media will be required for 
proper analysis and specific permission by this search and seizure warrant to remove the 
computer equipment and search it over time at a later date is sought. 

BACKGROUND ON PEER-TO-PEER NETWORKS AND THIS UNDERCOVER 
OPERATION 

1 7. Your affiant knows from training and experience that child pornography comes from many 
sources. Computers have revolutionized the way in which those sources and users interact. 
Computers have also revolutionized the way in which collectors and users of child pornography 
can keep their collections. The development of computers and the Internet has greatly changed 
and added to the way in which child pornography is disseminated, collected, and viewed. 

1 8. Computers have facilitated the ability of child pornography collectors and traders to keep their 
collections hidden. Photographs and videos that were previously stored in boxes are now traded 
and collected as digital images that can be stored and maintained on electronic media, such as a 
digital storage device called a "Micro Secure Digital Card", that is smaller than a postage stamp. 
Computers and the Internet now aid and serve in the production of child pornography, the 
distribution of child pornography, the viewing of child pornography, the storage of child 
pornography and communication between child pornography traders. 

19. One of the fast growing areas that facilitates and is used by child pornography collectors and 
traders is the P2P networks like FastTrack, EDonkey, Bittorrent and the Gnutella Networks. The 
Peer-to-peer (P2P) Networks have become ideal for traders to openly exchange collections and 
share those collections. The P2P network has provided a way for traders to have what they feel is 
an open and anonymous distribution and trading network. This network enables trading on a 
world-wide basis and with upload and download speeds as if the trader was next door. 

20. Your affiant has personally worked undercover P2P investigations and knows from training, 
research, personal experience in undercover investigations involving P2P networks, and by 
personal participation in the undercover program the following information, 

2 1 . Your affiant knows that computers on the eDonkey and Gnutella networks have software 
installed on them that facilitate the trading of images. The software, when installed, allows the 
user to search for pictures, movies and other digital files by entering text as search terms. Some 
names of the software used include, but are not limited to, eDonkey, BearShare, Frostwire, 
LimeWire, Shareaza, Morpheus, Gnucleus, Phex and other software clients. Those are software 
programs that interface with the Gnutella Network and the eDonkey network. 

22. P2P file sharing networks, including the Gnutella and eDonkey networks, are frequently used to 
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trade digital files of child pornography. These files include both image and movie files. 

23. P2P file sharing programs are a standard way to transfer files from one computer system to 
another while connected to a network, usually the Internet. Peer-to-Peer file sharing programs 
allow groups of computers using the same file sharing network and protocols to connect directly 
to each other to share files. 

24. Many P2P file sharing networks are designed to allow users to download files and frequently 
provide enhanced capabilities to reward the sharing of files by providing reduced wait periods, 
higher user ratings, or other benefits. In some instances, users are not allowed to download files 
if they are not sharing files. Typically, settings within these programs control sharing thresholds. 

25. With a computer connected to the Internet, an individual computer user can make electronic 
contact with millions of computers around the world. This connection can be made by any 
number of means, including modem, local area network, wireless and numerous other methods. 

26. To access the P2P networks, a user first must purposely seek out P2P software for sharing on the 
internet and then obtains the P2P software, which can be downloaded from the Internet. This 
software is used exclusively for the purpose of sharing digital files. When the P2P software is 
installed on a computer, the user is directed to specify a "shared" folder. All files placed in that 
user's "shared" folder are available to anyone on the world-wide P2P network for download. 
Most P2P software gives each user a rating based on the number of files he/she is contributing to 
the network and on the user's bandwidth and firewall settings. This rating affects the user's 
ability to download files. The more files a user is sharing, the greater his/her ability is to 
download files. This rating system is intended to encourage users to "share" their files, thus 
propagating the P2P network. However, a user is not required to share files to utilize the P2P 
network. 

27. A user obtains files by conducting keyword searches of the P2P network. When a user initially 
logs onto the P2P network, information about the files that the user is sharing is transmitted to the 
network. The P2P software then matches files in these file lists to keyword search requests from 
other users. A user looking to download files simply conducts a keyword search. The results of 
the keyword search are displayed and the user then purposefully selects file(s) which he/she 
wants to download. There is no accidental download process. The download of a file is achieved 
through a direct connection between the computer requesting the file and the computer(s) hosting 
the file. Once a file has been downloaded, it is stored in the area previously designated by the 
user and will remain there until moved or deleted. Most of the P2P software applications keep 
logs of each download event. Frequently, a computer forensic examiner, using these logs, can 
determine the Internet Protocol ("IP") address from which a particular file was obtained. 

28. Thus, a person interested in sharing child pornography with others in the P2P network, need only 
place those files in his/her "shared" folder(s) or leave the files they download in the shared folder. 
Those child pornography files are then available to all users of the P2P network for download 
regardless of their physical location. For instance, a person interested in obtaining child 
pornography can open the P2P application on his/her computer and conduct a keyword search for 
files using a term such as "preteen sex." The keyword search would return results of files being 
shared on the P2P network that match the term "preteen sex." The user can then select files from 
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the search results and those files can be downloaded directly from the computers) sharing those 
files. 

29. One of the advantages of P2P file sharing is that multiple files may be downloaded in parallel. 
This means that the user can download more than one file at a time. In addition, a user may 
download parts of one file from more than one source computer at a time thus speeding up the 
rate at which a single file is downloaded. For example, a user downloading an image file may 
actually receive parts of the image from multiple computers. The user's computer then 
reassembles those parts into the single file. This reduces the time it takes to download the file, A 
P2P file transfer is assisted by reference to an Internet Protocol (IP) address. This address, 
expressed as four numbers separated by decimal points, is unique to a particular Internet 
connection during an online session. The IP address provides a unique location making it 
possible for data to be transferred between computers. 

30. Even though the P2P network links together computers all over the world and users can download 
files, it is not possible for one user to forcefully send or upload a file to another user of the P2P 
network. The software is designed only to allow files to be downloaded that have been selected. 
One does not have the ability to send files from his/her computer to another user's computer 
without their permission or knowledge. Therefore, it is not possible for one user to send or 
upload child pornography files to another user's computer without his/her computer's active 
participation. 

3 1 . Based on your affiant's training and experience, your affiant also know the following about the 
operation of the eDonkey file-sharing network: 

32. The eDonkey network is also known as the eDonkey2000 file-sharing network, or eD2k. Users 
of this network can simultaneously provide files to users while downloading files from other 
users. It is one of the many P2P networks across the globe. 

33. The eDonkey network can be accessed by computers running several different client programs. 
These programs share common protocols for network access and file sharing. The user interface, 
features and configuration may vary between clients and versions of the same client. During the 
default installation of an eDonkey client, settings are established which configure the host 
computer to share files. Depending upon the eDonkey client used, a user may have the ability to 
reconfigure some of those settings during installation or after the installation has been completed. 

34. Typically, a setting establishes the location of one or more directories or (shared) folders whose 
files are made available for distribution to other eDonkey users. 

35. Typically, a setting controls whether or not other users of the network can obtain a list of the files 
being shared by the host computer by asking for a "browse" of the other computer's file list. 

36. Typically, a setting controls whether or not users will be able to share portions of a file while they 
are in the process of downloading the entire file. This feature increases the efficiency of the 
network by putting more copies of file segments on the network for distribution. 



37. Files on the eDonkey network are uniquely identified using a MD4 root hash of a MD4 hash list 
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of pre-determined chunks of the file. This treats files with identical content but different names 
as the same, and files with different contents but the same name as different. 



38. The ed2k hash function is a MD4 root hash of a list of MD4 hashes from the chunks of the file, 
and gives a different result than a simple MD4 hash: The file data is divided into full chunks of 
9500 KB (9728000 bytes or nearly 9.28 MB) plus a remainder chunk, and a separate 128-bit 
MD4 checksum is computed for each. If the file length is an exact multiple of 9500 KB, the 
remainder zero size chunk is still used at the end of the hash list. The ed2k hash is computed by 
concatenating the MD4 checksums of all the pieces of the file in order, and hashing the resulting 
sum using MD4. Although, if the file is composed of a single non-full chunk, its MD4 hash is 
used with no further modifications. This method of hashing allows the recipient to verify that a 
hash list corresponds to the original ed2k file hash, without the need to have the data blocks. 

39. Files located in a user's shared directory are processed by the P2P client software. As part of this 
processing, a MD4 root hash value is computed for each file in the user's shared directory. 

40. The eDonkey network uses MD4 root hash values to improve network efficiency. Users may 
receive a selected file from numerous sources by accepting segments of the file from multiple 
users and then reassembling the complete file on the local computer. The client program succeeds 
in reassembling the file from different sources only if all the segments came from exact copies of 
the same file. The network uses MD4 root hash values to ensure exact copies of the same file are 
used during this process. 

41 . The MD4 (or Message-Digest Algorithm) is a cryptographic hash function developed by Ronald 
Rives in 1990. The digest length is 128 bits. The mathematical and statistical probability of a 
collision is less than a collision of the same DNA in humans. 

42. The eDonkey software allows the user to search for pictures, movies and other files by entering 
descriptive text as search terms. These terms are typically processed by peers based upon the 
information about the files that had been sent by individual users. Your affiant knows through 
personal experience the query results presented to the user of the P2P Networks allows the user to 
select a file from the list of files returned during a query, and then receive that file from other 
users around the world. Often these users can receive the selected movie from numerous sources 
at once. The software can balance the network load and recover 

43. Entering search terms into an eDonkey client returns a list of files and descriptive information 
including, in some client software, the associated MD4 root hash values. Your affiant knows 
from training and personal experience, trial searches, and working undercover cases on the P2P 
networks that users can find images and movies of child pornography by using these search 
terms. Some examples of search terms that locate files containing child pornography are "PTHC" 
(which stands for "Pre-Teen Hard Core"), "babyj", "pedo", "kiddie", "underage", and various 
terms relating to ages such as "lOyo", etc. These search terms typically results in the user being 
presented with a list of files that include movie and image files that when downloaded and viewed 
contain child pornography illegal in NC, Your affiant has tested other search terms and results 
and has been able to successfully identify potential child pornography on the P2P network. Your 
affiant knows that automated tools can be used to automate the search process for those terms and 
then used to identify those offering for trade, files that have those terms in them. Your affiant 




14 



Additional Affiant: Signature/Date 



Additional Affiant: Signature/Date 



knows that those returned lists of IP addresses offering those files for trade can be scanned 
specifically for digital signatures (hash values) of known or suspected child pornography by those 
same automated tools and that the information can be recorded and examined by jurisdictions 
across the country. 

44. A person is able to compare the MD4 root hash values of files being shared on the network to 
previously identified MD4 root hash values of any file, including child pornography. Using a 
publicly available eDonkey client a user can select the MD4 root hash value of a known file and 
attempt to receive it. Once a specific file is identified by a search, the download process can be 
initiated. Once initiated, a user is presented with a list of users or IP addresses that have recently 
been identified as offering to participate in the distribution and become download candidates for 
that file. This allows for the detection and investigation of computers involved in possessing, 
receiving and/or distributing files of previously identified child pornography. 

45. Your affiant knows and has been able to confirm from use of the software and from downloads of 
files containing the same hash values that files received from different locations with identical 
hash values contain the same content. Each of the files may be named differently, but contain the 
exact same file and content as long as the hash values were identical for each file. 

46. Your affiant knows from training and experience in computer investigations that networked 
computers identify each other by an Internet Protocol or IP address. Your affiant knows that 
these IP addresses can assist law enforcement in finding a particular computer on the Internet. 
These IP addresses can typically lead the law enforcement officer to a particular Internet Service 
Provider, and that company can typically identify the account that used the IP address to access 
the Internet at a given date/time. IP addresses belong to an assigned user much the same as phone 
numbers except that they are assigned for shorter periods than typical phone numbers. Internet 
Service providers purchase blocks of IP addresses and then supply them to customers as they 
connect to the Internet. A customer cannot get access to the Internet except through a uniquely 
assigned IP address. No two computers on the Internet can have the same external IP address on 
the Internet at the same time. 



47. A customer of an Internet Service Provider can be identified by logs kept by their Internet Service 
Provider/ Electronic Service Provider which details the IP address assigned to them just like a 
customer of a phone company can be identified by their phone number. Your affiant has had 
experience in numerous situations using subpoenas and court orders issued to Internet Service 
Providers for identifying information. Your affiant knows that providers routinely, as part of 
business, maintain records of who they issue IP addresses to at any given time. Those IP address 
records are maintained by date, time and IP address and also contain other identifying subscriber 
information. The legal process papers, can and do routinely result in identification of the user 
that was assigned that specific IP address on a given date and time. 

48. The IP addresses can also be used to identify the location of these computers through 
Geographical IP look up services available on the Internet like Maxmind.com. Computers can be 
located this way that are reported to be specifically in Rockingham County, North Carolina area. 
A review of the MD4 root hash signatures shown in a routine search for files with child 
pornography terms allows an investigator to identify the files that are child pornography, based 
on that unique MD4 root hash. 
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49. The returned list of IP addresses can include computers that are likely to be within this 
jurisdiction. The ability to identify the approximate location of these IP address is provided by IP 
geographic mapping services, which are publicly available and also used for marketing and fraud 
detection. At this point in the investigative process, a recent association between a known file 
(based upon MD4 root hash comparison) and a computer having a specific IP address (likely to 
be located within a specific region) can be established. 

50. Once this association has been established, an investigator can attempt to download the file from 
the associated user or view the contents of the user's shared directory. Depending upon several 
factors including configuration and available resources, it might not be possible to do either. 

5 1 . Depending on the associated user configuration and available peer resources a listing of the files 
being shared may be displayed. In order to obtain this list of files, a direct connection between 
the computers must occur. This list can be a partial listing of the shared files. The file list can 
only be obtained if the associated peer is connected to the network and running an eDonkey client 
at that moment. Obtaining a file list via a "browse" is akin to asking a public library to send a list 
of books in their collection. The "browse" function does not enter the other computer merely but 
asks the other computer to send the information. A "browse" command is available to any and all 
users on the Gnutella Network. Users can share or have files in their shared folder available for 
searches and downloads on the P2P Networks. Users can also disallow "browsing" of their 
shared files. Anyone who routinely uses and downloads files would know they are downloading 
from other users who have allowed file sharing on their computer as that is the whole concept and 
reason for installing a P2P client of software. Conversely, they would also know that certain files 
on their computer are available for download unless they intentionally change the configuration 
of the client software to disallow those downloads and browsing commands from others on the 



52. By receiving either a file list or portions of a download from a specific IP address the investigator 
can conclude that a computer, likely to be in this jurisdiction, is running an eDonkey client and 
possessing, receiving and/or distributing specific and known visual depictions of child 
pornography. 

53 . This investigation of peer-to-peer file sharing networks is a cooperative effort of law enforcement 
agencies around the country. Many of these agencies are associated with the Internet Crimes 
against Children Task Force Program or the Federal Bureau of Investigation. Many of the 
officers involved in this effort are using the technology and methods described herein. This 
methodology has led to the issuance and execution of search warrants around the country 
resulting in many seizures of child pornography and arrests for possession and distribution. 

54. Your affiant conducted his investigation using the Child Protection System ("CPS") suite of 
tools. CPS was created by, at the direction of, and remains maintained by law enforcement 
officials in Boca Rattan FL. CPS is a law-enforcement maintained database utilized by federal, 
state and local law enforcement agencies in child exploitation investigations worldwide. CPS 
maintains a log of IP addresses that have been previously involved in the possession and 
distribution of child pornography. Your affiant has verified that the information concerning your 
affiant's actions while using the database had been logged into the database in a timely and 
accurate manner. Files are automatically compared to a known set of hash values as contained in 
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the database that evidence child pornography from previous investigations by other law 
enforcement officers. 



55. The data acquired from automated tools and undercover operations, including hash value, IP 
address offering to participate in distribution of a file, name of the file, date and time it was 
identified by CPS provided from the suspect computer, are all compiled into a user-friendly 
interface. Your affiant queried CPS for a particular geographic region or jurisdiction - in this 
case, Rockingham County, NC. Upon selecting an IP address to investigate, the information 
available of the servers historically about that IP address is generated and sent by CPS for the 
investigating officer to review. 

56. NordicMule is a software tool based on the eMule software program, a publicly available P2P 
client that operates on the eDonkey network. NordicMule was originally adapted from eMule by 
The Norway National Criminal Investigative Service for law enforcement purposes. NordicMule 
was then modified for law enforcement investigations to function within the CPS suite of tools, 
discussed above. Functionality and features were added to create a software tool that identifies 
computers offering to share files associated with the exploitation of children on the eDonkey 
network. 

57. NordicMule works by regularly downloading ed2K links (eDonkey magnets) from the CPS 
servers. Those links are file hashes previously viewed by law enforcement and known to contain 
depictions of child sexual abuse. As NordicMule receives information from sharing peers about a 
known file, it attempts to connect and browse that peer. NordicMule identifies what each 
individual and specific computer is offering for transfer based on IP address. Thus the 
information acquired is not from multiple sources, but from specific IP addresses at specific dates 
and times. All information submitted to the CPS servers is the result of individual peer 
computers responding to a request from NordicMule. Information that is logged to the CPS 
servers contains the police officer's license number. 

58. NordicMule searches for files of known or suspected child pornography and then records the IP 
addresses of those computers offering to participate in the distribution of known or suspected 
child pornography. NordicMule reads the publicly available information from computers that are 
identified as offering child sexual abuse images for distribution. This software reads these 
reported offers to participate in the sharing of child pornography and reports the IP address, the 
time, the date, the ED2K MD4 value, the type of software in use, the GUID number (or serial 
number) of the software, and the filename for each computer offering in a consistent and reliable 
manner to the undercover servers housed in Florida. Your affiant has validated this software by 
running identical search terms through manual methods with open source software and the 
automated system using NordicMule and has confirmed that NordicMule performs in the same 
way, with matching results as the previous manual investigative techniques used in this operation 
to date. The automated tools like NordicMule in use in the undercover operation provide 
beneficial data to undercover officers by automatically identifying and logging IP addresses that 
are offering to distribute child pornography. The software is distributed and run by thousands of 
investigators whose software then contributes to a global database. Your affiant has access to 
those automated logs and can check and see who in and around this jurisdiction (Rockingham 
County) is participating in and offering child pornography for distribution on the P2P networks. 
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59. Your affiant then selected the option to monitor a particular IP address; in this case 
24.148.156.21 1 on July 20, 2012. When the IP address was online in the eDonkey Network, your 
affiant's computer would automatically begin to download the files available for trade by the 
suspect computer. This is done through a law enforcement-only designed system, which your 
affiant refers to as Undercover Investigative Software (hereinafter referred to as UIS), currently 
used in state and local Peer-to-Peer P2P file sharing investigations and utilized through the CPS 
suite of tools. It this particular case it was used to request a download of the files of child 
pornography from IP address 24. 1 48. 1 56.2 1 1 . Downloading is a transfer of data from one 
computer to another. Since your affiant was doing the download, your affiant was receiving data, 
which was transmitted from another computer. This software is designed by and for law 
enforcement and only available to law enforcement officers who have attended the appropriate 
training. Your affiant has done so and conducts that training for others. The UIS is designed to 
connect directly to one IP address and browse or download from one specific peer at a time using 
technology to block all other IP addresses from delivering any piece of the file. The UIS is a P2P 
file sharing client similar to other file sharing which are free and available to the public. 

60. Using source code from a free P2P client, the UIS was modified by/for law enforcement to meet 
the stringent investigative requirements of these cases. For example, the UIS will only download 
files from a single source - the target IP, while the public version will download from many 
sources. The UIS thus takes much longer to download files because of the single source 
limitation. The UIS uses only publicly available P2P options which follow the programming 
language (protocols) set forth in the public P2P protocol standards. No functionality outside of 
the publicly available protocols is added, thus eliminating any potential private intrusion on the 
suspect IP's computer or files. The UIS uses the same code and language that is available to any 
and all software developers. 

61. Upon locating an IP address on the P2P networks that is evidencing Hash Values of known 
images/videos of child pornography as acquired from the CPS, the IP address is launched into the 
UIS by the investigator. An automated function of the UIS will attempt to connect to the IP 
address when it is observed being "on-line" and send a request to browse (i.e. look at and log the 
information being transmitted -a file list - and/or shown by that IP) and/or download a file from 
the shared folder of the computer utilizing that IP address. If the connection is not made to either 
browse or download, the UIS automatically continues to attempt to make a connection with the IP 
address. 

62. If a connection is made with the suspect IP address, the UIS will log the connection. It will also 
log the browse and/or download in the "logs" - the activity associated with that IP addresses' 
activity. Files are then downloaded directly into your affiant's computer and segregated from any 
other evidence. Prior to beginning an investigation using the UIS, your affiant creates a folder 
structure on the hard drive of your affiant's own computer instructing the UIS to the file path of 
where to store files that are downloaded and logs that are created. Both the downloaded files 
themselves as well as the logs will be reported in the appropriate folders created for the target 
peer IP address by your affiant. The logs identify that a known Hash Value of child pornography 
has been located, that the download transfer started, that the transfer is in fact processing, and that 
the transfer of the file is complete. The length of time the download process takes depends on the 
size of the file and speed of the internet/computer of both your affiant and the target IP's 
computer. 
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63. When a file has successfully completed the download process the UIS notifies your affiant 
electronically. The UIS, being based on P2P program design, ensures that files are obtained 
directly from the target IP address - assuring a single-source download so that any downloaded 
file comes directly from the suspect IP address. 

64. Your Affiant has validated the UIS by conducting investigations manually using publicly 
available P2P clients and compared the results with the automated UIS process and found the 
results to be exactly the same. 

SPECIFIC FACTS ABOUT THE IP ADDRESS AND PLACE TO BE SEARCHED 

65. The IP address 24.148.156.21 1 was first logged in the CPS undercover system by the automated 
tools previously described on 07/20/2012 offering to participate in the distribution of child 
Pornography known to me, Between 07/20/2012 and 07/26/2012, the IP address 24.148.156.21 1 
was logged, showing a continual pattern of child pornography, by the automated tools. That IP 
address was logged as offering to participate in the distribution of 3 files of known or suspected 
child pornography during that period of time. Of those 3 files logged your affiant has seen in 
prior investigation and can attest that he knows personally that 2 of them are indeed child 
pornography as defined by the North Carolina General Statutes. The other 1 are known by other 
officers participating in the undercover operation to be child pornography. The 2 that are known 
by your affiant can be described as follows: 

Ed2k hash value: 60492779477159DD2DA1DB8EE57D6995. File name: "Ptsc Mom & Daughter 
In Bath.mpg." Detective Bridge has personally seen and knows the file with this digital signature 
to be a movie file that shows an adult female in a shower with a prepubescent female. Later 
in the video, the prepubescent female is show masturbating and using a vibrator. The 
adult female and prepubescent female engage in oral sex, along with other sex acts. 

ED2k hash value: A09A2871D9140290B87128F7FD593234. File Name: "(Pthc) Russia lOYo- 
HYo Little Brother And Sister-2 - Boy&Girls Fucking_ Just Posing Or Naked l.avi". 
Detective Bridge has personally seen and knows the file with this digital signature to be a 
video that shows two preteen boys on a bed who get nude and have sex in various 
positions with a young teen girl Other clips show nude children playing in the sand and 
in various sexual positions on a bed. 



66. Utilizing the UIS, your affiant connected to the IP address 24.148.156.21 1 on July 21, 2012 
between 0550 hrs EDT and 1639 HRS EDT and was able to directly download parts 
(1 153339KB) of 2 video files of the sexual performance of a child. Your affiant has viewed the 
said file and it is believed to be Child Pornography based upon North Carolina Statutes, and is 
described as follows: 

The file names were Mom & Daughter In Bath.mpg with an ED2k hash value of 
60492779477159DD2DA1DB8EE57D6995 Detective Bridge has personally seen and knows the 
file with this digital signature to be a movie file that shows an adult female in a shower 
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with a prepubescent female. Later in the video, the prepubescent female is show 
masturbating and using a vibrator. The adult female and prepubescent female engage in 
oral sex, along with other sex acts. 

67. The partial downloaded version I obtained directly from IP address 24.148.156.21 1 matches 
portions of what was described above and is playable and viewable and the viewable portion 
contains child pornography even though it is a portion of the entire file, 

68. The second file name is (Pthc) Russia lOYo-HYo Little Brother And Sister-2 - Boy&Girls Fucking_ 
Just Posing Or Naked l.avi this video shows two preteen boys on a bed who get nude and 
have sex in various positions with a young teen girl. Other clips show nude children 
playing in the sand and in various sexual positions on a bed. The partial downloaded version 
I obtained directly from IP address 24.148.156.21 1 matches portions of what was described above 
and is playable and viewable. 

69. The UIS was also able to identify the software in use by that IP address as eMule v0.5 and also a 
Globally Unique Identification number associated with the computer using his IP address. The 
GUID associated with this address at the time of the download was 

8348EFA7A30EF645C3D806F648766F26 . A GUID is assigned to the computer when a file 
sharing program (such as E-Mule or any other peer-to-peer file sharing platform) is placed onto 
the computer. This series of numbers and letters is a unique serial number generated for each 
computer running P2P software around the world. Should the computer be used to access the 
Internet from a different IP address the GUID will remain the same as it is intrinsic to the 
computer system in almost all software programs. Further, should the user of the computer 
update the file sharing program with a newer version, a new GUID will be assigned to the 
computer for the updated program. 

70. Your affiant determined, by using Internet websites that the IP address 24. 1 48.1 56.2 1 1 where 
child pornography was downloaded from, on the dates listed above was owned by Earth Link as 
the Internet Service Provider (ISP). On August 7, 2012 I contacted SBI Agent Gerald Thomas 
who forwarded my request for an administrative subpoena to Cheryl King of the NCSBI. Ms. 
King filed and administrative subpoena for the IP address 24. 1 48. 1 56.2 1 1 for the subscriber 
information on July 21, 2012 at 0400 GTC. Records below indicate 24.148.156.21 was assigned 
to the following Earth Link customer for the time request. The following information was 
returned by Earth Link on August 8, 201 1 : 

Subscriber Name: Roberta Hill 

Service Address: 413 N 2 nd AVE 

Telephone #: 336-510-7972 

User Name: ms21842365@earthlink.net 

71. Time Warner's information described the IP address as issued to the above subscriber from 
03/1 3/2009 to the date of the return of service. 
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72. In verification of the occupants of 413 N 2 nd Ave. Your affiant obtained the NC 
Department of Motor Vehicles Driver License information for Roberta Hill NC 0L# 
8867196 that information listed her current address as 413 N 2 nd Ave. It listed her 
as having a Pontiac Sunfire registered at that address license number PWA6942. 
Brian David Hill is also listed with the NC Department of Motor Vehicles at this 
address with a NC 0L# 38360908. 

73. Based on the foregoing identification by IP address 24.148.156.211 a computer at the location 
of the IP addresses and physical address listed in this affidavit (24.148.156.21 1) offered for 
distribution files with ED2K values that are known or suspected to contain child pornography and 
sent to your affiant files containing child pornography. A reasonable officer with the proper 
training and experience could infer and conclude from the logs that the computer at the reported 
IP addresses recently offered for distribution files with digital signatures of known or suspected 
child pornography. It could also be inferred with a high degree of certainty, on your affiant's 
part, that the (Digital Signatures-or hash values) and IP addresses logged were sharing or offering 
to share those files on the eDonkey Network to other users. Therefore there is probable cause 
to believe that there is evidence (child pornography files and computer trace evidence listed 
in this warrant) of a continual pattern in July of 2012 on-going possession and distribution 
of child pornography through the P2P network (second degree sexual exploitation of a 
minor) (G.S. 14-190.17) located on the premises of 413 N 2 nd Ave, Mayodan NC, the Home of 
Roberta Hill W/F DOB: 05/14/1967 NC OLN: 8867196 and Brian David Hill W/M DOB: 
5/26/1990 NC OLN: 38360908, and/or any other person at the residence of at 4 1 3 N 2 nd 
Ave Mayodan NC to include any vehicles located at that address: specifically registered to 
Roberta Hill W/F DOB: 05/14/1967 NC OLN: 8867196 that are associated with the home: a 
200 Pontiac Sunfire Plate # PWA6942. 

74. In your affiant's training and experience with computers your affiant has found that many 
individuals store their computers (laptops) inside vehicles at the residence and failure to 
check the vehicles may have result in not finding the computer at the residence. In your 
affiant's training and experience the lease of the IP address is not always the one who used 
the computer on the network and frequently others in homes where an IP address is 
assigned can just as well be the perpetrator. As a result it is imperative to search for all 
computers in the home and or vehicles in order to determine who actually offered child 
pornography and distributed child pornography to me. It is highly probable in your affiant's 
training and experience with this network that a household member of the account 
identified by Earth Link is active in possession and sharing known or suspected child 
pornography on the P2P network. A search of that residence where the Cable Internet 
subscription come back to and the computers and routers at that residence will reveal who 
at that residence has been involved in active participation in the distribution, possession, 
receipt, and sharing of child pornography files. 
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Detective Robert W. Bridge 
Reidsville Police Department 

Sworn to and subscribed before 
Me this, the 2 g 8ay of /j< 

Judicial Official S ^ p 




Signature: Judicial Official/Date Signature: Law Enforcement/Date 

Additional Affiant: Signature/Date Additional Affiant: Signature/Date 



STATE OF NORTH CAROLINA 


i 


File No. 


Rockingham County 


In The General Court Of Justice 
□ District □ Superior Court Division 


IN THE MATTER OF: 






Name 

Roberta Ruth Hill 
Brian David Hill 


INVENTORY OF ITEMS SEIZED 
PURSUANT TO SEARCH 






G.S. 15A-223, 15A-254. -257 


1, the undersigned officer, executed a search of: 


Person, Premises Or Vehicle Searched 




Date Of Search 


Roberta Ruth Hill / Brian David Hill and the premises and property located at 413 North 2nd Avenue 
in Mayodan, North Carolina. 


08/28/2012 



This search was made pursuant to 

12 1 a search warrant issued by- Detect i ve Sergeant Todd Brim/Mayodan PD and Detective Robert Bridge/Reidsviile PD 
□ 2. consent to search given by: Signed by Superior Court Judge L. Todd Burke 



□ 3. other legal justification for the search: 

The following items were seized: 

. See Attachment Entitled "Receipt For Evidence And/Or Property" Form 



(Over) 

AOC-CR-206, Rev. 5/98 Original - File Copy - Person Whose Property Seized 

©1998 Administrative Office of the Courts 



Items Seized Continued: 



U 3 ban* Sssa 

2012 AUG 2S P 2-- 2U 

ROCKIKGHAH COUNTY. C.S.G. 
BY. (£1 LI 



01. I left a copy of this inventory with the person named below, who is: 
0 a. the owner of the premises searched. 

□ b. the owner of the vehicle searched. 

□ c. the person in apparent control of the premises searched. 

□ d. the person in apparent control of the vehicle searched. 

□ e. the person from whom the items were taken. 

□ 2. As no person was present, I left a copy of this inventory: 

□ a. in the premises searched, identified on the reverse. 

□ b. in the vehicle searched, identified on the reverse. 

Name And Address Of Person To Whom A Copy Of This Inventory Was Delivered, If Any 



The law enforcement agency identified below will hold the seized property subject to court order. 



SWORN AND SUBSCRIBED TO BEFORE ME 


Sianat^e Of^av^^^cement Officer 


Date 

08/28/2012 


Title Of Law EnforcemenUJmc% — " 

Detective Sergeant 


Signature • 


Name And Address Of Agency 

Mayodan Police Department 
101 North 3rd Avenue 
Mayodan, North Carolina 27027 


[jy Deputy CSC Q Assistant CSC 
| | Clerk Of Superior Court Q Magistrate 






\, the undersigned, received a copy of this inventory. 


Date 


Signature of Person Receiving Inventory 


AOC-CR-206, Side Two. Rev. 5/98 
©1998 Administrative Office of the Courts 



MPD-337 



RECEIPT FOR EVIDENCE AND/OR PROPERTY 



OCA / Case Number. 

2012-00287 



Department: 



Mayodan Police Department 



Location: 

101 North 3rd Avenue, Mayodan, NC 27027 



Name of person from whom the property was obtained: 
Roberta Ruth Hill / Brian David Hill 



Address / Telephone Number: 

413 North 2nd Avenue, Mayodan, NC 27027 



Location from which the property was obtained: 

Bedroom / Basement / Living Room 



Purpose for which the property was obtained: 

Evidence of Child Pornography 



Officer / Agent receiving property: 
Todd Brim/Mayodan PD / Robert Bridge/Reidsville PD 



Date / Time evidence and/or property was obtained: 
August 28, 2012 / 1400 



Item # 


Quantity 


Description Of Articles 
(Include model, serial number, identifying marks, 
condition, and dollar value, when appropriate.) 


Property 
Value 


Pi 


l 


Sentry Safe (Gray) Serial # BB-1 81417 








Containing aluminum foil, 3 books and 14 CD's. 




P2 


l 


Gateway Desktop Computer El 400 with power cord 








Serial # 0019564691 






n 


CD's 






l 


Kodak Camera 






l 


DELL Precision Desktop Computer 








Serial # 565920156 






l 


Acer Laptop Computer Aspire 3613LCi 








Serial # LXA740512553407C35KS00 




P3 


l 


Blue CD case #20 w/14 CD's 






l 


Blue CD case #20 w/128 CD's 






l 


Black Mainstays CD case w/186 CD's 






l 


Black/Gray MediaTote CD case w/116 CD's 







1 


Gray/Black Mainstays CD case w/48 CD's 






1 


Black/Yellow CD case w/16 CD's 






1 


Black Sentry CD case w/54 CD's 






1 


Black Sentry CD case w/80 CD's 




P4 


1 


Gateway Laptop Computer Navy Blue M-6827 








Serial # T4B8621005334 






1 


Compaq Laptop Computer Navy Serial # 1V1CKNV1KZEL 





MPD-337 



RECEIPT FOR EVIDENCE AND/OR PROPERTY 


OCA / Case Number: 

2012-00287 


Department: 

Mayo dan Police Department 


Location: 

101 North 3rd Avenue, Mayodan, NC 27027 


Name of person from whom the property was obtained: 
, Roberta Ruth Hill / Brian David Hill 


Address / Telephone Number: 

413 North 2nd Avenue, Mayodan, NC 27027 


Location from which the property was obtained: 

Bedroom / Basement / Living Room 


Purpose for which the property was obtained: 

Evidence of Child Pornography 


Officer / Agent receiving property: 

Todd Brim/Mayodan PD / Robert Bridge/Reidsville PD 


Date / Time evidence and/or property was obtained: 
August 28, 2012 / 1400 


Item # 


Quantity 


Description Of Articles 
(Include model, serial number, identifying marks, 
conQinon, ano. uoiiar vaiue, wnen approprid.i,ej 


Property 
Value 


P6 




Model F9K1105V1 


<<<Continued 






Password: de34d699 Pin: 02421209 






l 


iPortable External HD Model i251U2B 






l 


Seagate External HD 500GB Serial # NA0EHTA5 






l 


Blue WILD DIVINE Project Device 








Serial # WDJ104-04437 






l 


WD Internal HD 80GB Serial # WCAMD3627505 






l 


Samsung Internal HD 80 GB Serial # S0DEJ1IL76961 9 






l 


Trigen Internal HD 4.3GB Serial # SV0432D/TGE 






l 


Hitachi Deskstar Internal HD 61.4GB 








Serial # CBULN9JN 






l 


WD Internal HD 32MB Cache Serial # WCAVY0752279 






l 


Maxtor Internal HD 100GB Serial # L23RJA6G 






l 


CompUSA USB LAN Wireless Adapter 







1 


Palm Pilot Tungsten Serial # 00V3V8N3H13Q 






1 


Calvary External HD Serial # 2TR100850 






9 


SD Cards in Black case 






34 


DELL Palm Pilot AXIM X51 






1 


Targus SC Card Reader USB 






1 


RCA Audio Recorder 






1 


Mini CD 





. Tint Form j 



MPD-337 



RECEIPT FOR EVIDENCE AND/OR PROPERTY 



OCA / Case Number: 

2012-00287 



Department: 



Mayodan Police Department 



Location: 

101 North 3rd Avenue, Mayodan, NC 27027 



Name of person from whom the property was obtained: 
Roberta Ruth Hill / Brian David Hill 



Address / Telephone Number: 

413 North 2nd Avenue, Mayodan, NC 27027 



Location from which the property was obtained: 

Bedroom / Basement / Living Room 



Purpose for which the property was obtained: 

Evidence of Child Pornography 



Officer / Agent receiving property: 

Todd Brim/Mayodan PD / Robert Bridge/Reidsville PD 



Date / Time evidence and/or property was obtained: 
August 28, 2012 / 1400 



Item # 

1 LC/ 111 Tr 


Oiianfitv 

U.Q.11 LI L y 


Dp^rrinfinn Of Arfirlp's 
(Include model, serial number, identifying marks, 
condition, and dollar value, when appropriate.) 


Pro hp Try 

Value 


P4 


1 


Gateway Laptop Computer Navy MS 2285 






1 


Compaq Laptop Computer Presario F50G Black 








Serial # CNF7295TU7 






70 


CD's 






1 


Black leather wallet w/safe keys 






1 


GE tape recorder 






1 


Laptop Disk Drive Serial # MK2017GAP 




P5 


1 


CD Tower w/4 CD's CompUSA 






1 


CD Tower w/41 CD's CompUSA 






1 


Black MediaTote CD case w/100 Cd's 






1 


Black/Navy H2100 Sentry Safe Serial # AY-723561 






1 


Kodak Camera 






2 


HP 2.1 MP Cameras 320 Model Silver 






1 


HP Video Camera DXG HD720P Black 






1 


Dazzle Card Reader 






1 


WD External HD Serial # WCAZA6610511 






1 


Seagate External HD Serial # NA1QGR1E 






34 


CD's 






3 


CD-R's 






1 


DVD-R 




P6 


1 


Belkin Wireless Router N450DB 


Continued>>> 
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RECEIPT FOR EVIDENCE AND/OR PROPERTY 



OCA / Case Number: 

2012-00287 



Department: 



Mayo dan Police Department 



Location: 

101 North 3rd Avenue, Mayodan, NC 27027 



Name of person from whom the property was obtained: 
Roberta Ruth Hill / Brian David Hill 



Address / Telephone Number: 

413 North 2nd Avenue, Mayodan, NC 27027 



Location from which the property was obtained: 

Bedroom / Basement / Living Room 



Purpose for which the property was obtained: 

Evidence of Child Pornography 



Officer / Agent receiving property: 

Todd Brim/Mayodan PD / Robert Bridge/Reidsville PD 



Date / Time evidence and/or property was obtained: 
August 28, 2012 / 1400 



Item # 


Quantity 


Description Of Articles 
(Include model, serial number, identifying marks, 

v^Ullu.lLlUJ.1, allU U.Ulld.1 Value, Wile 11 appiUpllaLt;.^ 


Property 
Value 


P7 


l 


Black Case Logic Laptop Case 






l 


Pink AT&T Cell Phone Nokia 






l 


INC Research USB HUB 






l 


Black Toshiba Laptop Computer 








Satellite C655D Serial # 2C276987Q 






l 


Silver Toshiba Laptop Computer 








Satellite L305 Serial # 49148099Q 






l 


Samsung Internal HD 60 GB Serial # 0427J1FT704679 






l 


Black/Yellow Body Glove CD case w/32 CD's 






l 


Teal CD case w/17 CD's 






l 


Pink CD case w/12 CD's 






l 


CD Tower w/30 CD's 






l 


Seagate External HD 1000GB Serial # 2GEYZQ96 






1 


Motorola Surfboard Model SB5100 








Serial # 05ZVN3985576 






14 


Iomega ZIP discs 






1 


Slick Media Recorder 






3 


SD Cards 






1 


Roll of Film Fugifilm 






11 


CD's 




P8 


1 


Gateway Laptop Computer MA3 





MPD-337 



RECEIPT FOR EVIDENCE AND/OR PROPERTY 0CA /Case Number: 

2012-00287 


Department: 

Mayodan Police Department 


Location: 

101 North 3rd Avenue, Mayodan, NC 27027 


Name of person from whom the property was obtained: 

Roberta Ruth Hill / Brian David Hill 


Address / Telephone Number: 

413 North 2nd Avenue, Mayodan, NC 27027 


Location from which the property was obtained: 

Bedroom / Basement / Living Room 


Purpose for which the property was obtained: 

Evidence of Child Pornography 


Officer / Agent receiving property: 

Todd Brim/Mayodan PD / Robert Bridge/Reidsville PD 


Date / Time evidence and/or property was obtained: 
August 28, 2012 / 1400 


Item* 


Quantity 


Description Of Articles 
(Include model, serial number, identifying marks, 
condition and dollar value when annrnnriate ) 


Property 
Value 


P8 


i 


Compaq Laptop Computer CQ50 








Serial # 2CE834LD4K 






i 


Compaq Laptop Computer 






i 


Red Plastic Container 




P9 


i 


Seagate Internal HD 40GB Model ST340810A 


*A11 P9 items were 






Serial # 5GC1SZYT 


voluntarily given as 




i 


Sandisk Cruzer 4GB Memory Key 


evidence by Brian Hill 




i 


ASUS Netbook Computer Model Eee PC 1005PEB 


on 8/29/12 at 1220 hours* 






Serial # 9C0AA5155554 


Added at 1320 to this 








inventory. 
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1 lint; 


i\tilud.bt;U. By. 


rvcLtJlvtJU. Dy. 


Purpose for Change of Custody 








Print Name: 


Print Name: 










Signature: 


Signature: 










Print Name: 


Print Name: 










Signature: 


Signature: 










Print Name: 


Print Name: 










Signature: 


Signature: 










Print Name: 


Print Name; 










Signature: 


Signature: 










Print Name: 


Print Name: 










Signature: 


Signature: 











Release to Owner or Other: (Name) 



Address: 



Destroy: 



Other: 



Item(s) 



(Name) 



on this receipt, pertaining to the investigation involving: 



/ 



(Address) 



(Court Docket Number) 



(IS) (ARE) no longer required as evidence and may be disposed of as indicated above. 
(If article(s) must be retained, do not sign, but explain in separate correspondence.) 



/ 



/ 



(judge / Superior / District Court) 



(Signature) 



(Date) 



The article(s) listed at item number(s) 

by the Evidence Custodian, in my presence, on the date indicated above. 



.(WAS) (WERE) destroyed 



Clerk of Superior Court (Signature) 



Evidence / Property Custodian (Signature) 
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Reporter forced back by Mayodan Police for asking Senator P. . 
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Reporter intimidated and booted from town council when asking a question I USWGO Alternative News 
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Reporter intimidated and booted from town council when asking a 
question 



USWGO Alternative News 

I Like 929 



C~J Leave a comment 



g§ July 10, 2012 by Brian D. Hill (Edit) 

Filed under Brian D. Hill's Articles, Building the Police State, 

USWGO 

Author: Brian D. Hill 



Note: This is all alleged since only I am coming forth about what happened to me. Of course the RockinghamUpdate 
reporter was around the area as well but I don't trust Rockinghamllpdate as they refused to cover any significant local 
stories about Mayodan citizens resisting the NDAA 2012 law. I am up for interviews and I promise that everything I say is 
the truth as it is my duty and responsibility to expose anything that doesn't seem right. I must tell people what happened 
while it is fresh in my mind although this has been posted days later after the draft has been made as I fear the police are 
watching my website and are looking for a way to come after me so I am laying low and publish this at least 3 days after 
the incident. Remember my witness report is just an alleged report since only I have decided to write on this. 




Click to check out our new Talk Radio Page 



Emergency donations needed for USWGO to 
pay for server in 4-5 days (Moneybomb) 
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Reporter intimidated and booted from town council when asking a question I USWGO Alternative News 



At around July 9th, 2012 during the Mayodan Town Council meeting, things go from bad to worse at the town council meeting, and 
all I did as a reporter was ask NC State Senator Phil Berger a question before the chief of police forced me out which is in the video 
I got recorded. Somehow I recorded audio when the cop forced me out the whole time and even left a remark to have fun with the 
New World Order multiple times before getting my stuff. There was no audio of the cop intimidating me though but at least I got a 
recording of part of the whole ordeal. 

First while the people were around and leaving the cop told me that when the session closes I am suppose to leave out of there so 
they can have their private meeting before the meeting is entirely closed. I didn't know all that so I should not have been treated like 
a criminal. Then of course the cop went further in making sure I never go up to state senator Phil Berger to ask him a question. 
Then minutes later when I was going to explain to the officer that I have type 1 brittle diabetes, he interrupted me then started telling 
me that the way I was going up to the state senator with a camera (Like I was in the wrong for that), told me how like those city 
council meeting videos on TV where someone comes sup quickly to shoot a political official, and acted as though I was coming up to 
him fast to do something terrible to him or even do something that threatens his life. He said that he knows that I didn't show that I 
was intending to do that but then he started saying to me that if I go up to the state senator like that again he will push me back or 
something like that. Basically he was gonna force me back as if I am gonna hurt him or go into a bar without an ID. That was the 
way he was acting and being close to me, close to my space. Then I told him I promise I won't do that again then he badgered me a 
little bit more then I said I am sorry and said scouts honor then he backed off. Then when my mom came in to the town hall office 



Protect Liberty, & Freedom 




Send news tips to: 
news.tips@nswio.eom 



All emails sent to this news tip email get forwarded to the 
appropriate editor, reporter, or the head reporter. 
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Reporter intimidated and booted from town council when asking a question I USWGO Alternative News 

area to check up on me, whenever she left she saw the chief of police watching us and that gave her a bad feeling. 

Mayodan Chief of Police and the entire town council is no doubt apart of the New World Order. They know who I am and they know 
what I stand for so I will have to lay low after the two postings I will make. Please stand for us or we will all hang separately. Even if 
they aren't 100% in on the New World Order money masters they are apart of this partially by some subsidiary group or pack of 
corporations that work with the Bilderberg Group. The town of Mayodan is not immune to the garbage and BS of the New World 
Order and that is a fact as a news reporter I have been in 2-3 years. 

Share and Enjoy: 

* Sfl 3> ■■ E b ^ D bj O ® Q □ m 4 -3 & 

Buzz this! 

/Tags: asking, booted, chief of police, intimidated, Police, question, reporter, town council 




Comments 

7 Comments on "Reporter intimidated and booted from town council when asking a question" 

■ Reporter intimidated and booted from town council when asking a question : Federal Jack on 
Tue, 10th Jul 2012 4:55 am (Edit) 

[...] Source: USWGO Alternative News [...] 

■ grandmastershek on Tue, 10th Jul 2012 11:01 am (Edit) 



n 



OMG!!! The asked you to leave! The horror! I always love how you guys have 
cameras but never show happening what you claim happened. 

Shit doesn't go your way so you guys cry like the butt hurt conspiracy loons you are. 
Life sucks... get over it. 



■ Police Chief Boots Reporter For Asking Senator About NDAA on Wed, 11th Jul 2012 10:47 

http://uswgo.com/reporter-intimidated-and-booted-from-town-council-when 9:03:41 PM] 
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(Made in 2011) Directed by Brian 0, Hill 

JIM TUCKER; PATRICK HENRY JOLLY; POPEYE; 
CHECK CREDITS FOR MORE OF THE CAST AND CREW 

PrtM Uift Bfett toW ifwmPM MfCl*«fC»J HMW *rmcrv«l Eryfqp 

Watch our New Documentary 
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Reporter intimidated and booted from town council when asking a question I USWGO Alternative News 
am (Edit) 

[...] Source: USWGO [...] 

■ Town of Mayodan Corruption is only the beginning of the elites TERROR | USWGO Alternative 
News on Mon, 16th Jul 2012 3:24 am (Edit) 

[...] from taking photos and video that would hurt the power of the power broker. That of course was 
the chief of police of Mayodan and other unknown security and police squads and the staffers at the 
Senate Office that [...] 



■ Congress looking to outlaw reporters right to report on criminal government corruption | 
USWGO Alternative News on Mon, 16th Jul 2012 4:12 am (Edit) 

[...] of the Press on our end has already been threatened at the Mayodan Town Council, where the 
chief of Police Charles Caruso forced me back and booted me [...] 



■ Terravita on Tue, 24th Jul 2012 12:07 pm (Edit) 

nl agree with the previous commenter. Why are you reporters feel yourselves hurt 

■ Your town and city may be a corporation and body politic | USWGO Alternative News on Mon, 
20th Aug 2012 2:36 pm (Edit) 

[...] the Mayodan chief police threatened and intimidated a reporter for asking a state senator a 
question, I decided to do more research on the Mayodan town [...] 



Tell us what you're thinking... 

and oh, if you want a pic to show with your comment, go get a gravatar! 

Logged in as Brian D. Hill. Logout » 
Speak your mind 
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Help pay for our goal of keeping our site online 
and be able to get millions of people every 

month without worrying over website 
suspension. Thank You to all who donate! 
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In case you get lost on our website ;) 



Reporter intimidated and booted from town council when asking a question I USWGO Alternative News 





5 




*63 


1 

Privacy & Terms 




rem- 

top spa 11 
>ad books. 



Submit Comment 



http://uswgo. com/reporter 4ntimidated-and-boote^ 9:03:41 PM] 



Search 



FAIR USE NOTICE 



Also any materials specially created by 
Brian D. Hill or USWGO Alternative news 
writers is freely given and can be rewritten, 
transmitted, republished, or reposted 
anywhere. We only require you give proper 
credits (Author name and link to source)to 
whomever did the work on our website. As 
long as you credit the original author of the 
work we don't have any problem with 
people sharing our work. Debating and 
bringing out the news shouldn't be under 
any copyright restriction as the press has a 
duty to report the news to prevent political 
corruption. Any news we create ourselves 
and not copied from any other source 
(Except news stories we create then repost 
from Federal jack)can be freely shared! 

This site contains copyrighted material the use of which 
has not always been specifically authorized by the 
copyright owner. We are making such material available 
in our efforts to advance understanding of 
environmental, political, human rights, economic, 
democracy, scientific, and social justice issues, etc. We 
believe this constitutes a 'fair use' of any such 
copyrighted material as provided for in section 107 of 
the US Copyright Law. In accordance with Title 17 
U.S.C. Section 107, the material on this site is 
distributed without profit to those who have expressed a 
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prior interest in receiving the included information for 
research and educational purposes. 
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Website powered by: 
Linux Web Hosting By HostforWeb 
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America's Wrongfully Convicted 

Armageddon Online - Disaster News & Future 
Scenarios 

Arrest the Bilderbergs 
Common Sense Conspiracy 
federal Jack 

Folks against the Fair Tax 
I support The Pirate Bay 
Info Wars 
Keep Resisting 
Mafia News Today 
Military Heroes Project 
Nanny State Liberation Front 
newsphiles 
NWOAIert 

People For Freedom 
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Political Lemmings 
PrisonPlanet 
Prophet666 
SEO Tips 
Social Credit 

SoMuch.com - Popular Internet Links Directory 

Techno anti-nwo Web List 

The American Ideals Foundation 

The Lemonade Revolt! 

UK Recession news and information 

Watch Dog Central! 

We Are Change Bakersfield 

WeAreChange Mayodan and Madison NC 

Activist Post 
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Do you think forced Internet IDs are a good 
idea? 

^ OYes 
^ONo 
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View Results 

^ Polls Archive 
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GENERAL AFFIDAVIT FROM BRIAN DAVID HILL REGARDING STATEMENT OF 
FACTS AND WITNESS TESTIMONY ON THE EMULE VIRUS, TROJAN HORSE, 

ROGUE PROGRAMS 

Location of witness incident: 

State of North Carolina 
County of Rockingham 
Town of Mayodan 

Location of affiant at the time the affidavit was notarized: 

State of Virginia 
County of Henry 
City of Martinsville 

BEFORE ME, the undersigned Notary, 

[name of Notary before whom 

affidavit is sworn], on this [day of month] day of [month], 

20 , personally appeared [name of 

affiant], known to me to be a credible person and of lawful age, who being by me first duly sworn, on 
[his or her] oath, deposes and says: 

Around sometime of July 2012, cannot remember the day but the problem may have lasted for anytime 
between less then one week to two weeks. Also at that time I did no remember using any Anti-virus 
software on my computer, and had to keep reminding myself to get the software and install on my 
computer but I cannot remember if I ever did, which means I don't think I used a anti-virus and if I did 
I would have clearly recalled. I started noticing that emule.exe was running along with three other 
programs. Conime.exe, ares.exe, and shareaza.exe. I believe the main program that was rogue and was 
running was emule.exe. It didn't run under the normal programs. This program ran without my consent, 
and without my knowledge until I discovered the program running in task manager. I had ended the 
tasks thinking this Trojan was gone but then days later I noticed that the hard drive space on my 
computer was out at Ok. I decided to open the program location using the task manager. I noticed it 
appeared to be a portable version of eMule, at least the folder structure looked similar. I clicked on the 
shared files folder and saw hundreds of files with names I didn't understand. Some of those names from 
what I could remember said 9yo, pthc, ptsc, and other terms. I assumed it was just some viruses being 
shared and deleted everything. I had no idea what was shared or that it was something that would get 
the police after me. Then I tried to sabotage the virus since it took over my computer and made it 
difficult to fight against. I even recall a bit about calling my grandmother on the phone telling her that I 
was fighting a virus or Trojan, and that is really all I recall. So I know I had called my grandmother 
telling her about this Trojan, and took days to put a stop to, if that was even enough as it could have 
still ran, but I wouldn't know. I believe there may be other Trojans running on the computer too due to 
the weird programs that were running. I should have restored my computer but did not because I had a 
lot of data I would have to move off the computer to conduct the restore. 

Honestly if I had known that the Trojan horse was sharing something serious that got me in trouble, if I 
had known earlier what was being shared then I would have reported the incident to the FBI or the 
NCMEC and sent the sample of this Trojan horse to Anti- Virus companies for examination then have 



them forward their findings to the FBI, then the ICAC wouldn't have falsely accused me of child porn. 
Maybe my life would have been different and I would not be at risk of possible indictment. I had no 
intent to exploit or harm any child. I would never intend to commit any crime serious enough to ruin 
my life. I'm not perfect but I ain't some jackal child predator criminal that wants to just go after 
children, that is not me. I have a dating profile on match.com and may have a possible girlfriend that is 
also a adult. I was a news reporter for my hobby blog platform titled US WGO Alternative News and it 
would be unethical and unprofessional for me to be downloading child porn. It's just something that 
would violate my own standards as a human being, as a news reporter, as a political activist, and as a 
autistic man. I did the Nullify-NDAA Petition in April to May where I gave it to my two state 
representatives(Bryan Holloway and Bert Jones), state senator(Phil Berger), to the town of Mayodan, I 
think the city of Reidsville, the City of Eden, the Rockingham County Sheriff, and I think the 
Rockingham County Commissioners. My petition drive was condemning government abductions, 
kidnappings, torture, and secret detention under the NDAA 2012, and even spoke out about this at the 
Mayodan Town Council repeatedly. 

After the police raid I decided to look up what I remember about the Trojan horse. I searched up the file 
names including emule.exe and found that others had suffered getting this virus and I think I tried to 
warn them that it could be sharing material that may get them in trouble warning them to report the 
virus to AV companies so that they can protect themselves from possible prosecution. I discovered from 
ESET's online website database on viruses that the trojan horse that I received could be the 
Win32/MoliVampire.A or possible a custom variant, linked below. I did not remember conime.exe until 
I saw this exact Trojan profile, then I was able to recall that there was a conime.exe file along with 
them and some other weird file names I cannot recall as it had funny characters so I wouldn't put that 
into my memory in my head. All I could remember was emule.exe, ares.exe, and shareaza.exe. 

http://www.vimsradar.eom/Win32_MoliVampire.A/description 

[set forth affiant's statement of facts] 



[signature of affiant] 

Brian David Hill 

[typed name of affiant] 

916 Chalmers St. 
[address of affiant, line 1] 
Martinsville, VA 241 12 
[address of affiant, line 2] 

Subscribed and sworn to before me, this [day of month] day of 

[month], 20 . 

[Notary Seal:] 



[signature of Notary] 



[typed name of Notary] 
NOTARY PUBLIC 
My commission expires: 
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https://mail. google. com/mail/u/l/?ui=2&ik=9 1 80eb3bc7&view=pt&q=ma. . . 



USWGO 



Brian Hill <catchall@uswgo.com> 



Welcome! Here's Your Registration Confirmation 



Match.com <mailer@connect.match.com> 
Reply-To: donotreply@connect.match.com 
To: "brian@uswgo.com" <brian@uswgo.com> 



Sat, Nov 9, 2013 at 1:16 AM 



match.com 



Welcome to the Leading 
Online Dating Site 




TARTED » 



Congratulations! You've joined the most dynamic group of singles 
out there. We're responsible for more dates, relationships and 
marriages than any other site. Period. 



Please review your account information 

Username: uswgo edit » You are a: Man edit » 

Password: | | ec |j t „ Seeking: Women edit » 

Birthday: May 26, 1 990 edit » ZIP code: 241 1 2 edit » 
Email: brian@uswgo.com edit » 




Finding a great date all starts Profiles with photos are 15 Search, wink and send emails, 

with writing a great profile. times more likely to be Or, jump right into the action 

Take a minute and let viewed and three times more and start chatting live with other 

everyone know exactly who likely to receive winks. members. 
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USWGO Mail - Welcome! Here's Your Registration Confirmation 



https://mail.googlexom/mail/u/l/?ui=2&ik=9180eb3bc7&view=pt&q=ma.. 



you are. Start Writing » Upload Photo » Search & Communicate » 



Like us on fZ§ Follow us on £?• Read our 

Facebook 1^1 Twitter bo] Slog 



Please add mailer@connect.match.com to your address book to ensure our emails reach your Inbox. 
Please do not reply to this email. Replies will not be received. 

If you have a question, or need assistance, please contact Customer Care by clicking on the following link: 
http://www.match.com/help/help.aspx 

MATCH.COM DOES NOT CONDUCT CRIMINAL BACKGROUND CHECKS ON 
ITS MEMBERS. PLEASE TAKE PROPER SAFETY PRECAUTIONS. See 
Online Dating Safety Tips. 
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https://nmil.googlexonVmail/u/0/?ui=2&ik=3b8027ea52&view=om&th=.. 



Delivered-To : admin@uswgo.com 

Received: by 10.52.35.44 with SMTP id el2csp9921vd j ; 

Sun, 7 Apr 2013 02:33:19 -0700 (PDT) 
X-Received: by 10.180.188.3 with SMTP id f w3mr7 1 635 60wic . 33 . 13 6532 7 1 98 92 1 ; 

Sun, 07 Apr 2013 02:33:18 -0700 (PDT) 
Return-Path : < johnsnatchz @ tormail . org> 

Received: from outgoing.tormail.org (outgoing.tormail.org. [82.221.96.22]) 

by mx.google.com with ESMTPS id xl7si32 90773wiv . 114 . 2013 . 04 . 07 . 02 . 33 . 18 

(version=TLSvl cipher=RC4-SHA bits=128/128 ) ; 

Sun, 07 Apr 2013 02:33:18 -0700 (PDT) 
Received-SPF : pass (google.com: domain of johnsnatchz@tormail.org designates 
82.221.96.22 as permitted sender) client-ip=82 . 221 . 96 . 22 ; 
Authentication-Results : mx . google . com; 

spf=pass (google.com: domain of johnsnatchz@tormail.org designates 82.221.96.22 
as permitted sender) smtp . mail= johnsnatchz@tormail . org; 

dkim=pass header . i=@tormail . org 
Received: from localhost ([127.0.0.1] helo=internal . tormail . org) 

by outgoing.tormail.org with esmtp (Exim 4.72) 

(envelope-f rom < johnsnatchz@tormail . org>) 

id lUOlyP-0004AS-55 

for admin@uswgo.com; Sun, 07 Apr 2013 13:33:17 +0400 
DKIM-Signature : v=l; a=rsa-sha256; q=dns/txt; c=relaxed/ relaxed; d=tormail . org; s=tm; 

h=Message-Id : X-TorMail-User : Content-Transfer-Encoding : Content -Type : MIME- 
Version: To : From: Sub ject : Date; bh=UwaG80h5 9dqOQA5W/xl zAcMK58GPawm6e8SGWuQxXUQ=; 

b= JHt 9P 0KX9opc2 j QT 9XYwaxI Z 8uFUKSM3 J+ j FLBP Z 9K+ j P2 JKLUN+KpM+hMVwF 8qHqy s 1 znN+f f E 6UdW jXECBpL 
yAO3XJly+TgW5tWHvsGWeGMBVe7Z0Nr/voAQBUBCX7uymhomH2Mmge jeAhPFdEraBWQ8t i 9Dwwu2 9P4 IGeOFg=; 
Received: from johnsnatchz by internal.tormail.org with local (Exim 4.63) 
(envelope-f rom < johnsnatchz@tormail . org>) 
id lUOlwB-OOOleb-DJ 

for admin@uswgo.com; Sun, 07 Apr 2013 09:30:59 +0000 
Date: Sun, 7 Apr 2013 09:30:59 -0000 

Subject: You better watch out 

From: johnsnatchz@tormail.org 
To: admin@uswgo.com 
MIME-Version: 1.0 

Content-Type : text/plain; charset=iso-8859-l 
Content-Transfer-Encoding: 8bit 
X-Conf irm-Reading-To : johnsnatchz@tormail . org 
Disposit ion-No t if icat ion-To : johnsnatchz@ tormail . org 
Importance: High 

Return-Receipt-To : johnsnatchz@tormail . org 
X-TorMail-User : johnsnatchz 

Mess age- Id: <lUOlwB-0 0 01eb-DJ@ internal . tormail . org> 

You better watch out Brian... We are watching you... Having child porn 
planted on your hard drives and computer was only the beginning and we 
will set you up for violent sex crimes if you don't watch your back... Have 
fun becoming a sex of fender ... Police won't believe you no matter how much 
evidence you have that you been set up we know some people in the SBI who 
will make sure you are convicted. You will be shut up by being a sex 
criminal. Your friends Alex Jones, Dan, James, Sean, Alex, and others are 
next . . . BeWare ! 



1 of 1 



12/5/2013 7:36 PM 



https://nmil.googlexonVmail/u/0/?ui=2&ik=3b8027ea52&view=om&th=.. 



Delivered-To : admin@uswgo.com 

Received: by 10.52.35.44 with SMTP id el2csp2 8 972vd j ; 

Sat, 20 Apr 2013 21:01:20 -0700 (PDT) 
X-Received: by 10.50.79.201 with SMTP id 19mrll943746igx . 79 . 1366516879989; 

Sat, 20 Apr 2013 21:01:19 -0700 (PDT) 
Return-Path : <sallysamsong@tormail . org> 

Received: from outgoing.tormail.org (outgoing.tormail.org. [82.221.96.22]) 

by mx.google.com with ESMTPS id v7 si 9502 951igd . 4 . 2013 . 04 . 20 . 21 . 01 . 19 
for <admin@uswgo . com> 

(version=TLSvl cipher=RC4-SHA bits=128/128 ) ; 
Sat, 20 Apr 2013 21:01:19 -0700 (PDT) 
Received-SPF : pass (google.com: domain of sallysamsong@tormail.org designates 
82.221.96.22 as permitted sender) client-ip=82 . 221 . 96 . 22 ; 
Authentication-Results : mx . google . com; 

spf=pass (google.com: domain of sallysamsong@tormail.org designates 82.221.96.22 
as permitted sender) smtp . mail=sallysamsong@tormail . org; 

dkim=pass header . i=@tormail . org 
Received: from localhost ([127.0.0.1] helo=internal . tormail . org) 
by outgoing.tormail.org with esmtp (Exim 4.72) 
(envelope-f rom <sallysamsong@tormail . org>) 
id lUTlSm-OOOOJb-VQ 

for admin@uswgo.com; Sun, 21 Apr 2013 08:01:18 +0400 
DKIM-Signature : v=l; a=rsa-sha256; q=dns/txt; c=relaxed/ relaxed; d=tormail . org; s=tm; 

h=Message-Id : X-TorMail-User : Content-Transfer-Encoding : Content -Type : MIME- 
Version : To : From: Subject : Date; bh=mhz zCyEqHr+qJJMocUaldBui JYraedoV9Rf TrBUwDCc=; 

b=ezsAUiX8HpiOLpuYZP3cK05Snv5WRrxd+KpeZVCGhKQPoaMczSgqm2pzkevD5Z+k/TqqKNmq 
/tsUhMR8RgG6RJIilwjPencyP3 

/k+cEa9NSvDF0eu+VTGlivN2 j vApoycUgt 8qc+vbt sM9ndTGbuuYioHnP4oYvM7LaRo/8 60f g=; 
Received: from sallysamsong by internal.tormail.org with local (Exim 4.63) 
(envelope-f rom <sallysamsong@tormail . org>) 
id lUTlQU-000MmQ-15 

for admin@uswgo.com; Sun, 21 Apr 2013 03:58:54 +0000 
Date: Sun, 21 Apr 2013 03:58:54 -0000 
Subject: Your gonna get it 
From: sallysamsong@tormail.org 
To: admin@uswgo.com 
MIME-Version: 1.0 

Content-Type : text/plain; charset=iso-8859-l 
Content-Transfer-Encoding: 8bit 

X-Conf irm-Reading-To : sallysamsong@tormail . org 
Disposit ion-No t if icat ion-To : sallysamsong@ tormail . org 
Importance: High 

Return-Receipt-To : sallysamsong@tormail . org 
X-TorMail-User : sallysamsong 

Mess age- Id: <lUTlQU-0 0 0MmQ-l 5 @ internal . tormail . org> 

Your gonna get it . . . .We know what your tryin to do . . . .You'll regret ever 
being an investigative news reporter .... Youll regret what you just 
did. .. .better watch your back Brian .... DONT REPORT ANY MORE ARTICLES OR 
TALK TO ANY REPORTERS ABOUT THIS CHILD PORN VIRUS OR YOU GONNA GET IT 
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